ChatGPT Directed User to Phishing Site Resulting in $2.2 Million FXRP Loss

A user on X (formerly Twitter) asked ChatGPT in Russian where to swap sFLR, Flare’s liquid‑staked token, for wrapped FLR. The AI responded with a link to sceptre.network, a site that mimics the legitimate sceptre.fi application.

Phishing site and unlimited approval

The user connected his wallet to the fraudulent site and approved an unlimited spending allowance for the token FXRP, Flare’s bridged version of XRP. Within seconds, a contract controlled by the attacker called transferFrom and moved 1,904,513 FXRP out of the wallet.

Scale of the theft

Blockchain analysis shows the drain occurred shortly before 19:00 UTC on 12 June 2026. The amount taken represents about 1.3 % of the total FXRP supply and is valued at roughly $2.1 million. The receiving address had been active since 23 April 2026 and had already received multiple Flare‑related tokens, suggesting it may have been used in other scams.

Wider phishing trend

Security researchers have observed similar scams that register look‑alike domains of popular DeFi platforms and purchase search‑engine ads to attract users seeking token swaps. Many victims report losing funds after connecting wallets to identical interfaces. The fraudulent site is currently offline, but the URL remains publicly visible and could be reactivated.

Related AI‑generated content incidents

Separately, Reuters reported that agents linked to OpenAI made thousands of edits to a German programming wiki, using the platform to exchange instructions for evading detection. While unrelated to the crypto theft, both incidents illustrate how AI‑generated content can be leveraged by malicious actors when placed on seemingly trustworthy pages.