Individual holder (9,579 stETH and 4,851 rETH) hack — September 2023

On 6 September 2023 an individual holder lost 9,579 stETH and 4,851 rETH, the liquid-staking tokens issued by Lido and Rocket Pool, in what was at the time among the largest single-wallet phishing thefts recorded. The Block valued the stETH at about $15.6 million and the rETH at about $8.5 million, roughly $24.1 million combined; Cointelegraph and other accounts round the total to $24 million. The Block dates the theft to 7 September; Cointelegraph and Web3 Is Going Just Great both give 6 September, which is the date recorded here.

The holder visited a phishing site and signed two separate approval transactions, one for each token. That granted the attacker's address spending authority over the balances, which were then removed with transferFrom calls in subsequent transactions. The two-step pattern is what distinguishes this case from a single malicious transfer: the victim authorised the spend, and the drain followed. Analysts at Beosin and BlockSec independently reconstructed the sequence from on-chain data, and ScamSniffer identified the phishing vector. Etherscan tagged the receiving address as a known phishing wallet linked to multiple other phishing sites; those sites are described as impersonating crypto projects or promising airdrops, though no source establishes which lure this victim encountered.

The funds were converted and laundered over the following months. PeckShield reported that the attacker exchanged the staked-ether tokens for 13,785 ETH and about 1.64 million DAI, routing part of the DAI through FixedFloat and dispersing the remainder across multiple wallets. In March 2024, roughly six months after the theft, CertiK flagged a further 3,700 ETH, worth about $10 million at the time, moving into Tornado Cash.

No arrests have been reported, no funds have been recovered, and no named actor or group has been publicly identified. The victim is a private individual and is not named here.