User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature
An Aave aEthLBTC holder
A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.
Why this severity: $1.1M reported stolen, 1 victims.
- Started
- Jan 3, 2026
- Closed
- Jan 3, 2026
- Chains
- Ethereum
- Reported stolen
- $1.1M
- Victims
- 1
At risk
- An Aave aEthLBTC holder
- Ethereum wallets
What to do now
- Check token permissions for your wallet and revoke any spender you do not know.
- If funds already moved, record the transaction hashes and report them to Scam Sniffer, SlowMist or the exchange the funds reach.
Stay safe
Am I affected?
Only if you signed a permit-style signature for Aave aTokens (or any token) on a site you did not trust. Aave aTokens support permit, so a signature alone can hand over the position.
What to do now
- Check token permissions for your wallet and revoke any spender you do not know.
- If funds already moved, record the transaction hashes and report them to Scam Sniffer, SlowMist or the exchange the funds reach.
How to avoid this
- Treat any signature that lists a spender, a value and a deadline as a spending approval.
- Keep large DeFi positions in a wallet you never connect to new sites.
- Use a hardware wallet with clear-signing so the permit details are shown before you approve.
Timeline 1
Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.
Source
News & write-ups ›1
How this method works
You sign what looks like a harmless login message, but it is an off-chain permission that lets the attacker move your tokens. No gas, no transaction, so it feels safe. Read about permit and permit2 signature phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.