Web3 anti-scam sleuth uncovers phishing attack that drained $4.2m using a malicious opcode