A crypto investor lost about $2.1 million after asking ChatGPT where to swap sFLR for WFLR and clicking a phishing link it suggested. On the fake site, the victim signed an "unlimited approve," handing the scammers access to their tokens.

How the theft went down

Right after the approval, the scammers drained 1.9 million FXRP (roughly $2.1 million) from the victim’s wallet. "Unlimited approve" lets a smart contract spend unlimited tokens from your wallet—if you sign this on a phishing site, your funds can be wiped out instantly.

Where the funds went and other victims

The same scammers hit several other users too. In total, losses topped $2.2 million. The stolen funds were swapped to DAI and ETH, with some routed through Tornado Cash to cover their tracks.

What we know now

The main trigger: clicking a phishing link and signing an unlimited token approval. This story is a wake-up call about trusting AI-generated links and highlights the need to double-check domains and smart contract permissions—especially when swapping tokens like sFLR, WFLR, and FXRP.