Ethereum user loses $440K in USDC after signing a malicious permit
An Ethereum USDC holder
An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.
Why this severity: $440K reported stolen, 1 victims.
- Started
- Dec 8, 2025
- Closed
- Dec 8, 2025
- Chains
- Ethereum
- Reported stolen
- $440K
- Victims
- 1
At risk
- An Ethereum USDC holder
- Ethereum wallets
What to do now
- Open a revoke tool (for example revoke.cash) and remove token permissions you do not recognise, including Permit2 allowances.
- Move remaining funds to a fresh wallet if you are unsure what you signed.
Stay safe
Am I affected?
Only if you signed a 'permit' or 'Permit2' signature request on a site you did not fully trust. These show up as a signature (not a transaction) that names a spender and a token amount.
What to do now
- Open a revoke tool (for example revoke.cash) and remove token permissions you do not recognise, including Permit2 allowances.
- Move remaining funds to a fresh wallet if you are unsure what you signed.
How to avoid this
- Read every signature request: if it names a spender and an amount, it can move your tokens.
- Never sign permits from links in DMs, ads or replies.
- Use a wallet or extension that decodes and warns on permit signatures.
Timeline 2
News & write-ups ›2
How this method works
You sign what looks like a harmless login message, but it is an off-chain permission that lets the attacker move your tokens. No gas, no transaction, so it feels safe. Read about permit and permit2 signature phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.