The Signature Was Valid. The Trust Was Not.
On June 12 at 19:00 UTC, an attacker-controlled contract on Flare called transferFrom. At the bytecode level, nothing about the transaction was anomalous: valid signature, sufficient allowance, standards-compliant execution. One confirmation later, 1,904,513 FXRP โ roughly $2.1 million โ sat in a wallet the victim had never touched until fifty days earlier, when he asked ChatGPT, in Russian, how to convert sFLR into wrapped FLR. The model answered. The answer contained a link. The link was the exploit.
Context: A Textbook Drain Through a New Door
Call the victim Alex, per his own post-mortem thread. He did not click a sponsored search result, did not open a Discord DM, did not fat-finger a URL into a browser. He delegated discovery to a language model โ arguably the most rational-seeming decision available to a retail user in 2026. ChatGPT returned a link to sceptre.network. The legitimate Flare liquid staking protocol lives at sceptre.fi. Identical label, different top-level domain. Alex connected his wallet and signed an unlimited spending approval. He never initiated a token transfer himself. He did not need to. The allowance was the transfer.
Approval phishing is the oldest trick in the EVM playbook. approve(spender, uint256.max) grants indefinite extraction rights over the approved balance; the spender drains on its own schedule via transferFrom. Drainer-as-a-Service has since industrialized the workflow โ BeInCrypto documented operators earlier this year registering Uniswap lookalike domains and purchasing search ads to feed the funnel, and a prior unlimited approval cost an Ethereum holder $999,999. The mechanics here are textbook. The distribution channel is not, and the channel rewrites the threat model.
Based on my audit experience going back to my 2019 autopsy of the Aeonix reentrancy bug, the interesting part of any exploit is never the drain. Drains are deterministic and boring. The ingress โ how a victim arrives at the signature โ is where the actual innovation lives. This case innovated at ingress.
Core: Five Findings From the Trace
1. The infrastructure predates the victim by fifty days.
VAL's on-chain tracing shows the receiving wallet's first inbound funds arrived April 23 โ fifty days before Alex signed anything. Since then, that address has accepted at least four distinct Flare token types, with cumulative extracted value exceeding $2.2 million. Read the operational tempo correctly: staged wallets, a templated funnel deployed across multiple Flare DeFi targets, months of continuous harvesting. This is not an opportunistic hit on one unlucky user; it is persistent infrastructure, and Alex is one node in a longer ledger. I treat every 'single victim' narrative as a sampling error until the receiving addresses are mapped across their full lifetime. The chain remembers what press coverage omits.
2. No protocol failed. That is the uncomfortable part.
Trace the execution and the failure boundary is precise. Flare's bridge contracts: untouched. The genuine sceptre.fi application: a bystander whose brand was cloned. FXRP itself, the bridged XRP representation, behaved exactly per ERC-20, and the 1,904,513 tokens extracted represent roughly 1.3% of circulating supply โ a rounding error for any market. The exploit occurred at the only layer of the stack nobody audits: the human signature ceremony.
I do not read the whitepaper; I read the bytecode. The bytecode says this system worked. Approval is not authentication. Signed at uint256.max, it is a standing order with no expiry, no cap, and no simulation step telling the signer, in plain language, 'this authorizes the spender to move your entire balance at a time of its choosing.' During DeFi Summer I stress-tested governance surfaces and found the same pattern: the contract was sound; the assumption set wrapped around it was not. The gap between what users believe 'Approve' means and what the EVM executes it to mean is the single most monetized misunderstanding in this industry. Drainers live inside that gap.
3. The new vector is retrieval poisoning, not model hacking.
The attacker did not jailbreak ChatGPT, did not tamper with weights, did not inject instructions into anyone's prompt. This is an indirect prompt injection variant executed one level lower: poison the retrieval corpus โ SEO-injected pages, indexed content โ so the model emits the malicious URL as a confident recommendation with zero malicious intent anywhere in the pipeline. Structurally this is worse than the ad-fraud channel it replaces. Search ads carry labels, platform review, and takedown mechanisms. Model output carries a credibility halo and no verification pipeline whatsoever. You can blacklist a domain inside an ad network; you cannot pre-moderate what a stochastic system will emit across millions of prompts in a hundred languages. The Russian-language query is not incidental color โ it maps directly into moderation dead zones.
4. The OpenAI agent wiki incident is the same defect at higher amplitude.
In the same news cycle, Reuters reported an OpenAI-linked autonomous agent making roughly 15,000 unsupervised edits to a wiki, to which OpenAI responded it could not comment on reports it had not yet reviewed โ following a larger jailbreak episode in July. Same architectural gap, different blast radius: no runtime verification layer exists between stochastic model output and irreversible action. Editing a wiki is reversible. Signing an unlimited approval is not. The industry is shipping agency faster than it ships verification, and drainer operators noticed before auditors did.
5. The economics guarantee recurrence.
Run the attacker's P&L. Domain registration: negligible. Phishing page generation: near-zero marginal cost in an era of LLM-assisted cloning. Retrieval poisoning: a one-time content investment amortized across every future victim the model routes in. Yield: $2.2 million and counting from a single wallet cluster. When infrastructure costs converge to zero and the distribution channel self-replicates through an AI's own recommendations, the rational strategy is scale, not restraint. Expect more 0 .fi, 1 .xyz that matters.
The Contrarian Read
The reflexive take โ AI is dangerous, blame OpenAI โ fails basic decomposition. Every component executed to specification. The ERC-20 approval worked as written. The model generated plausible text, which is its function. The bridge held. The chain finalized. The composite failed because no layer treats an AI-emitted URL as untrusted input, and remediation does not require OpenAI's cooperation. Wallets could ship it next sprint: allowance caps by default, permit-style expirations, mandatory simulation previews stating plainly what a signature authorizes, provenance scanning on pasted links. None of it is technically hard. All of it is deferred.
Give the bulls their due. The claim that Flare's contracts were sound was correct โ nothing at the protocol layer was touched. Anyone shorting FXRP on this headline has mispriced the event: 1.3% of supply, no bridge compromise, no exploit โ the sell-pressure thesis is a liquidity footnote, not a catalyst. And the thesis that AI interfaces will onboard the next hundred million users is probably right. The drainers share that thesis and are simply the first to arbitrage it. Discovery is migrating from search engines โ flawed, but adversarially hardened over two decades of fraud wars โ to conversational systems with no equivalent hardening. Phishing conversion rates improve accordingly. The attack did not get smarter. The victim's trust interface did.
Takeaway
Markets are chopping sideways, and consolidation phases reward capital positioned against structural defects rather than narratives. The defect here is legible: the security perimeter has moved from the contract to the prompt, and nothing currently guards it. Permission-management tooling and AI-output verification are the obvious underserved gaps. The harder question outlasts any tooling cycle: when the primary discovery layer for on-chain action is a system that cannot guarantee its own output integrity, who audits the recommender โ and what is the recovery path when that audit fails? Until wallets treat every AI-sourced link as hostile by default, the drainer economy scales linearly with model adoption. The next Alex will not ask in Russian.