Approval Phishing: From Just One Case to Full-Scale Disruption

**Executive summary:** This Chainalysis report explains how approval-phishing investment scams trick victims into granting malicious wallet approvals, describes the on-chain infrastructure and cash-out patterns used by scammers, summarizes large coordinated disruption efforts (Operations Spincaster, DeCloak, Atlantic) and quantified impact (industry losses cited at $14–17B in 2025 and millions frozen/seized), and provides operational recommendations to detect and disrupt these campaigns (upstream detection, rapid pivoting, information-sharing, and building in-house capabilities).