6.2 million ETH; it wasn't a phishing link at play, but rather his own finger that clicked 'confirm' after repeatedly verifying on the screen. Until his assets were wiped out, he couldn't understand: he was using a Trezor hardware wallet, with the private key stored in a safe and the mnemonic phrase split into three parts, never using public WiFi for operations... how could he still be 'cleaned out'?

Upon reviewing his on-chain logs, the issue lay in the word 'authorization'. It turned out that for the sake of convenience in monitoring the market, he installed a so-called 'decentralized' wallet plugin and connected it to his Trezor device. This plugin appeared 'especially reliable': it supported hardware wallet offline signing, could display NFT floor prices and DeFi yields, and was recommended by several big names on Twitter. He thought it was just 'looking at data' and posed no risk.

Little did he know, at the moment he bound the device, the 'confirm authorization' he clicked allowed this contract direct control over all of his addresses. He signed an 'ApprovalForAll' permission contract, with the authorized party being a hacker disguised as a 'cross-chain bridge' contract. Five days later, right after he withdrew 6.2 million ETH from the exchange, the hacker triggered a preset function and instantly transferred all balances away. Throughout the process, the hardware wallet displayed no pop-up, and the app only showed 'contract interaction'.

He indeed did not click 'transfer', but this authorization was like a 'pre-signed blank power of attorney'; the other party could transfer as much as they wanted without needing his further consent. After we intervened, we tracked the contract call chain and the authorization activation time, marked the flow of funds from the victim's address and mixing services, contacted relevant exchanges to freeze the implicated assets, assisted the police in securing electronic evidence, and conducted cross-border investigations. Currently, 30% of the assets have been frozen in intermediary wallets.