$ALI, $PUSH Tokens Phishing Hack

TOTAL LOST $4.4M
Medium Phishing Attacks

What happened

Quick Summary

Massive Loss: $4.39M of $ALI and $PUSH Tokens Lost to Crypto Phishing

Details of the Exploit

A staggering $4.39 million worth of $ALI and $PUSH tokens were recently lost to a crypto phishing scam. The victim, identified by the address 0x7653c936…6a744e, fell prey to the scam orchestrated by scammers with addresses 0x84672cc5…9e29cd and 0x2ee9a175…621edb. The victim inadvertently signed a malicious Uniswap Permit2's Permit Batch message, facilitating the unauthorized transfer of tokens.

Notably, the token spender involved is a Safe wallet address.

Block Data Reference

Victim's Address: 0x7653c936…6a744e

Scammer 1 Address: 0x84672cc5…9e29cd

Scammer 2 Address: 0x2ee9a175…621edb

Exploit tx:

https://etherscan.io/tx/0xc943ea89…9417cc

Case & protocol details

Classification Token
Protocol Type Exploit/Phishing

Evidence & learning

Attack pattern

Compare incidents →
Phishing Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Whale Wallet Drain $25.6M
USDC Permit Signature Phishing $1.8M
Social Engineering Scam $282M
Address Poisoning Attack $50.0M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes