{
 "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
 "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
 "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
 "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "permit-phishing",
 "product": "An Aave aEthLBTC holder",
 "tags": [
  "ethereum",
  "permit-phishing",
  "permit",
  "aave",
  "lbtc",
  "atoken",
  "tornado-cash",
  "scam-sniffer",
  "slowmist"
 ],
 "amountUsd": 1080000,
 "victims": 1,
 "startedAt": "2026-01-03",
 "closedAt": "2026-01-03",
 "updatedAt": "2026-01-03T12:00:00Z",
 "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.",
 "timeline": [
  {
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Unlucky phishing victim loses $1.08M after signing malicious 'permit' signature",
   "url": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "publisher": "Cryptopolitan",
   "date": "2026-01-03"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you signed a permit-style signature for Aave aTokens (or any token) on a site you did not trust. Aave aTokens support permit, so a signature alone can hand over the position.\n\n## What to do now\n- Check token permissions for your wallet and revoke any spender you do not know.\n- If funds already moved, record the transaction hashes and report them to Scam Sniffer, SlowMist or the exchange the funds reach.\n\n## How to avoid this\n- Treat any signature that lists a spender, a value and a deadline as a spending approval.\n- Keep large DeFi positions in a wallet you never connect to new sites.\n- Use a hardware wallet with clear-signing so the permit details are shown before you approve.",
 "notes": null,
 "agentBrief": "# User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Ethereum · Method: Permit and Permit2 signature phishing\n- Started: Jan 3, 2026 · Last update: Jan 3, 2026 · Reported stolen: $1.1M · Victims: 1\n- Who/what: An Aave aEthLBTC holder\n\nA user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.\n\n## Am I affected?\nOnly if you signed a permit-style signature for Aave aTokens (or any token) on a site you did not trust. Aave aTokens support permit, so a signature alone can hand over the position.\n\n## What to do now\n- Check token permissions for your wallet and revoke any spender you do not know.\n- If funds already moved, record the transaction hashes and report them to Scam Sniffer, SlowMist or the exchange the funds reach.\n\n## How to avoid this\n- Treat any signature that lists a spender, a value and a deadline as a spending approval.\n- Keep large DeFi positions in a wallet you never connect to new sites.\n- Use a hardware wallet with clear-signing so the permit details are shown before you approve.\n\n## Sources\n- Unlucky phishing victim loses $1.08M after signing malicious 'permit' signature (Cryptopolitan, 2026-01-03): https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/\n\nFull record: https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026 · JSON: https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}