ChatGPT Gave Him a Link. Seconds Later $2.1 Million Was Gone

A crypto trader has reported losing roughly $2.1 million after following a link that appeared inside a ChatGPT answer, in what on-chain investigators describe as one of the clearest cases yet of an AI chatbot delivering a victim straight to a phishing site.

The user, who posts as Alex under the handle @vesnuhin, says he asked ChatGPT in Russian where he could swap sFLR, Flare's liquid-staked token, for wrapped FLR. It is an ordinary question with an ordinary answer. The reply he received contained a link.

"Lost ~1.9M FXRP to an approval-phishing scam," he wrote. "I asked ChatGPT where to swap sFLR for WFLR. Its answer contained a link — it led to a phishing site."

The photograph he posted of his own screen is the clearest artefact in the case. His question sits at the top right. Below it the model lists four routes — Sceptre, Enosys DEX, SparkDEX, BlazeSwap — each footnoted with a source chip, in the confident register of an answer that has been checked. The cursor rests on the first of them, and the link tooltip that has opened underneath reads https://sceptre.network/?utm_source=chat….

One signature, and seconds to drain

That domain was a lookalike. It imitated Sceptre, the Flare liquid-staking interface that actually lives on a different top-level domain, and it was close enough to survive a glance at the address bar — closer still when the name arrives inside a numbered list with a citation beside it. Alex connected his wallet and signed what the site asked for: an unlimited token approval.

That single signature is the whole story. An approval does not move funds by itself. It grants another address a standing allowance to move them later, and an unlimited approval sets that allowance to effectively everything, forever. The attacker simply called transferFrom and took the balance. On-chain records put the transfer shortly before 19:00 UTC on 12 June 2026.

The amount was 1,904,513 FXRP — Flare's bridged representation of XRP — worth around $2.1 million and equal to roughly 1.3% of the token's entire supply. Alex posted about the loss the following day.

Following the money

The case resurfaced on 3 September 2026, when the blockchain investigator who posts as VAL published a trace of where the funds went. "Over $2.2M stolen through a phishing site that ChatGPT was handing out as an answer on where to swap $FLR," the thread opens. "One victim alone lost $2.1M."

The stolen balance was converted out of Flare assets and moved through DAI and then into ether, with roughly 380,000 DAI sitting in one wallet, a further 310,000 DAI pushed onward, and 889 ETH parked at another address at the time of the analysis.

Alex was probably not alone. The receiving wallet was not new — blockchain data shows its first funds arrived on 23 April, fifty days before he signed — and it has since taken in at least four different Flare tokens.

There was a second sting. Alex says that in the aftermath he was contacted not by anyone who could help but by recovery scammers, the operators who follow public loss reports and offer, for a fee, to claw back funds that nobody can claw back. He has warned others not to engage with them.

The link that is no longer there

When VAL went back and queried ChatGPT in several languages, the phishing link no longer came up. That is the most unsettling detail in the whole episode, because it means the failure was not permanent and not obviously visible. Whatever surfaced that domain — a poisoned page in the model's sources, a scraped listing, a plausible-looking URL assembled on the spot — it is gone now, and it was there long enough to cost someone $2.1 million.

Neither OpenAI nor the Flare ecosystem projects involved have published a detailed account of how the link came to be produced.

Comment: keep chatbots away from your money

Here is the part worth saying plainly, because the industry keeps declining to say it: do not trust AI chats and AI bots when it comes to crypto or financial services. Not for links. Not for addresses. Not for which platform to use, which token to buy, or whether a contract is safe.

This is not a complaint about one bad answer from one product. It is about what these systems are. A language model produces the most plausible continuation of your text. It has no register of which domains are real, no way to check who registered one last week, and no concept of consequence attached to getting it wrong. It will hand you a working URL and a hostile URL in exactly the same confident sentence, because to the model they are the same kind of object: a string that looks like a link.

Look again at what Alex was shown. Four options, numbered. Source chips beside each one. A closing paragraph offering to work out the cheapest route if he said where his sFLR was held. Every signal of diligence was present except the one that mattered, which is that somebody had checked the domain. Nobody had. Nobody could have.

Attackers understood this before most users did. Registering a lookalike domain and seeding it across the open web is cheap, and it does not need to fool a human reader — it only needs to end up in the pool of text a model draws on. When it works, the model does the hardest part of the con for free: it supplies the trust. A link that arrives in a chat window does not feel like an advert or a search result. It feels like an answer.

Crypto is where this gets expensive fastest, because crypto has no undo. There is no chargeback, no fraud department, no five-day window to call the bank. An approval signed at 18:59 is final at 19:00. But the same reasoning applies well beyond tokens. Do not let a chatbot route you to your bank's login page, your broker, your tax portal or your insurer. The cost of being wrong is not a bad recommendation. It is your account.

What to do instead

• Never navigate from a chatbot. Treat any URL in an AI answer as unverified. Get addresses from the project's own channels, then bookmark them and use the bookmark every time after that.
• Read the approval, not the button. If a site asks for permission rather than a payment, that permission is the transaction. Set a spending cap instead of approving an unlimited allowance, and revoke old approvals you are no longer using.
• Split your balances. Anything you are not actively trading does not belong in the wallet you connect to websites.
• Slow down on the last click. Phishing does not survive a second look at the domain — it survives being in a hurry.
• Ignore anyone offering recovery. Nobody can reverse a signed transaction. Everyone who says otherwise is running the second scam.

Use an AI assistant to understand what a liquid-staking token is, or what transferFrom does, or why an unlimited allowance is dangerous. Those are questions about concepts, and a wrong answer costs you nothing but a correction. The moment the question turns into where do I go and what do I sign, close the chat and do the work yourself.

Alex asked a reasonable question and got an answer that read like every other answer. That is precisely the problem.