On June 12, 2026, a cryptocurrency user lost approximately $2.1 million in FXRP tokens after following a phishing link provided in a ChatGPT response. The user, identified as Alex, sought information on swapping sFLR for WFLR tokens. The link directed him to a fraudulent website where he granted unlimited token approval to his wallet.
Following the approval, the attacker used the transferFrom function to drain 1.9 million FXRP. Blockchain investigators from VAL reported that the stolen assets were moved across multiple wallets and networks. Part of the funds was converted from FLR to DAI via the OpenOcean platform, while other portions were converted into ETH.
Investigators identified 889 ETH on one of the associated wallets and noted a transfer of 50 ETH to the Tornado Cash mixer, suggesting an attempt to obfuscate the transaction trail. VAL experts confirmed that the phishing link could not be replicated in subsequent tests, indicating that ChatGPT served only as a delivery channel for the malicious link.
This incident aligns with broader trends where attackers leverage AI services and search engines to distribute phishing links. In August 2026, Hyperliquid users lost $550,000 due to fake Google ads. Security analysts emphasize that the primary risk lies in social engineering and the signing of malicious wallet permissions rather than vulnerabilities in the AI tools themselves.
