Crypto User Says ChatGPT Phishing Link Led to $2.1M FXRP Drain

Points of Focus

• A user said he lost $2.1 million in FXRP after following a phishing link he received in a ChatGPT response.
• An unlimited token approval gave the attacker permission to move 1.9 million FXRP.
• Blockchain investigator VAL said the wider operation stole over $2.2 million and routed funds through DAI, ETH, and Tornado Cash.

A crypto user said he lost 1.9 million FXRP, worth about $2.1 million at the time, after following a phishing link that appeared in a ChatGPT response and signing an unlimited token approval. The June 12 drain drew renewed attention on Sept. 3 after blockchain investigator VAL published a trace of the wider phishing operation.

Unlimited approval enabled 1.9-million FXRP drain

Alex, who reported the loss on X, said he asked ChatGPT in Russian where to swap sFLR for WFLR. He said the response included a link to a site he believed was suitable for the trade, where he connected his wallet and signed an “unlimited approve.”

Seconds later, according to Alex, the attacker used the ERC-20 “transferFrom” function, which lets an approved spender move tokens from another wallet, to remove about 1.9 million FXRP. 

Alex had intended to swap sFLR for WFLR, yet the approval granted spending access to FXRP, the asset that was later drained. The sequence is consistent with an approval-phishing attack rather than a swap failure.

Lost ~1.9M FXRP to an approval-phishing scam.

I asked ChatGPT where to swap sFLR for WFLR. Its answer contained a link — it led to a phishing site. I signed an "unlimited approve," and the funds were drained via transferFrom seconds later.

Tx:… pic.twitter.com/1waLIWyotG

— Alex (@vesnuhin) June 13, 2026

FXRP is an ERC-20 representation of XRP on Flare. Under the ERC-20 standard, “approve” gives a spender permission to withdraw tokens up to a specified amount, while “transferFrom” allows an authorized spender to move those tokens from the owner’s address. An unlimited allowance can remain available until it is changed or revoked.

Lost ~1.9M FXRP to an approval-phishing scam.

I asked ChatGPT where to swap sFLR for WFLR. Its answer contained a link — it led to a phishing site. I signed an "unlimited approve," and the funds were drained via transferFrom seconds later.

Tx:… pic.twitter.com/1waLIWyotG

— Alex (@vesnuhin) June 13, 2026

Investigator traces funds as ChatGPT link claim remains user-reported

VAL said on X that the broader phishing operation had stolen more than $2.2 million. The investigator traced related funds through FLR and Dai (DAI) conversions, reporting that 50 Ether (ETH) later reached Tornado Cash and that another wallet held 889 ETH when the trace was published.

1/ Over $2.2M stolen through a phishing site that ChatGPT was handing out as an answer on where to swap $FLR

One victim alone lost $2.1M

Here's a full overview of the operation and where the stolen funds are now pic.twitter.com/q0F6qdJD5S

— VAL (@osint_based) September 3, 2026

The victim and VAL attribute the discovery of the phishing site to ChatGPT, but the reports reviewed for this story don’t include independent confirmation from OpenAI. VAL said later tests in several languages no longer returned the reported phishing link.

OpenAI said third parties can mislead ChatGPT or insert malicious instructions into online content and advises users to review destination websites before trusting generated links. 

In Alex’s account, the last user authorization before the drain was the unlimited token approval, followed seconds later by the transfer of about 1.9 million FXRP.