{
 "slug": "permit-phishing-440k-usdc-dec-2025",
 "title": "Ethereum user loses $440K in USDC after signing a malicious permit",
 "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025",
 "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "permit-phishing",
 "product": "An Ethereum USDC holder",
 "tags": [
  "ethereum",
  "permit-phishing",
  "permit",
  "erc-2612",
  "usdc",
  "scam-sniffer",
  "signature-phishing"
 ],
 "amountUsd": 440358,
 "victims": 1,
 "startedAt": "2025-12-08",
 "closedAt": "2025-12-08",
 "updatedAt": "2025-12-09T12:00:00Z",
 "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.",
 "timeline": [
  {
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832"
  },
  {
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "What a $440,000 Hack Shows About the Rising Threat of Ethereum 'Permit Scams'",
   "url": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "publisher": "Decrypt",
   "date": "2025-12-09"
  },
  {
   "kind": "social",
   "title": "Scam Sniffer alert: $440,358 USDC lost to malicious permit signatures",
   "url": "https://x.com/realScamSniffer/status/1998018496635207832",
   "publisher": "Scam Sniffer (X)",
   "date": "2025-12-08"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly if you signed a 'permit' or 'Permit2' signature request on a site you did not fully trust. These show up as a signature (not a transaction) that names a spender and a token amount.\n\n## What to do now\n- Open a revoke tool (for example revoke.cash) and remove token permissions you do not recognise, including Permit2 allowances.\n- Move remaining funds to a fresh wallet if you are unsure what you signed.\n\n## How to avoid this\n- Read every signature request: if it names a spender and an amount, it can move your tokens.\n- Never sign permits from links in DMs, ads or replies.\n- Use a wallet or extension that decodes and warns on permit signatures.",
 "notes": null,
 "agentBrief": "# Ethereum user loses $440K in USDC after signing a malicious permit\n\n- Severity: High · Status: Contained (past)\n- Chains: Ethereum · Method: Permit and Permit2 signature phishing\n- Started: Dec 8, 2025 · Last update: Dec 9, 2025 · Reported stolen: $440K · Victims: 1\n- Who/what: An Ethereum USDC holder\n\nAn Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.\n\n## Am I affected?\nOnly if you signed a 'permit' or 'Permit2' signature request on a site you did not fully trust. These show up as a signature (not a transaction) that names a spender and a token amount.\n\n## What to do now\n- Open a revoke tool (for example revoke.cash) and remove token permissions you do not recognise, including Permit2 allowances.\n- Move remaining funds to a fresh wallet if you are unsure what you signed.\n\n## How to avoid this\n- Read every signature request: if it names a spender and an amount, it can move your tokens.\n- Never sign permits from links in DMs, ads or replies.\n- Use a wallet or extension that decodes and warns on permit signatures.\n\n## Sources\n- What a $440,000 Hack Shows About the Rising Threat of Ethereum 'Permit Scams' (Decrypt, 2025-12-09): https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams\n- Scam Sniffer alert: $440,358 USDC lost to malicious permit signatures (Scam Sniffer (X), 2025-12-08): https://x.com/realScamSniffer/status/1998018496635207832\n\nFull record: https://drains.watch/i/permit-phishing-440k-usdc-dec-2025 · JSON: https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}