# User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature

- Severity: Critical · Status: Contained (past)
- Chains: Ethereum · Method: Permit and Permit2 signature phishing
- Started: Jan 3, 2026 · Last update: Jan 3, 2026 · Reported stolen: $1.1M · Victims: 1
- Who/what: An Aave aEthLBTC holder

A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.

## Am I affected?
Only if you signed a permit-style signature for Aave aTokens (or any token) on a site you did not trust. Aave aTokens support permit, so a signature alone can hand over the position.

## What to do now
- Check token permissions for your wallet and revoke any spender you do not know.
- If funds already moved, record the transaction hashes and report them to Scam Sniffer, SlowMist or the exchange the funds reach.

## How to avoid this
- Treat any signature that lists a spender, a value and a deadline as a spending approval.
- Keep large DeFi positions in a wallet you never connect to new sites.
- Use a hardware wallet with clear-signing so the permit details are shown before you approve.

## Sources
- Unlucky phishing victim loses $1.08M after signing malicious 'permit' signature (Cryptopolitan, 2026-01-03): https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/

Full record: https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026 · JSON: https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.