# Ethereum user loses $440K in USDC after signing a malicious permit

- Severity: High · Status: Contained (past)
- Chains: Ethereum · Method: Permit and Permit2 signature phishing
- Started: Dec 8, 2025 · Last update: Dec 9, 2025 · Reported stolen: $440K · Victims: 1
- Who/what: An Ethereum USDC holder

An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.

## Am I affected?
Only if you signed a 'permit' or 'Permit2' signature request on a site you did not fully trust. These show up as a signature (not a transaction) that names a spender and a token amount.

## What to do now
- Open a revoke tool (for example revoke.cash) and remove token permissions you do not recognise, including Permit2 allowances.
- Move remaining funds to a fresh wallet if you are unsure what you signed.

## How to avoid this
- Read every signature request: if it names a spender and an amount, it can move your tokens.
- Never sign permits from links in DMs, ads or replies.
- Use a wallet or extension that decodes and warns on permit signatures.

## Sources
- What a $440,000 Hack Shows About the Rising Threat of Ethereum 'Permit Scams' (Decrypt, 2025-12-09): https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams
- Scam Sniffer alert: $440,358 USDC lost to malicious permit signatures (Scam Sniffer (X), 2025-12-08): https://x.com/realScamSniffer/status/1998018496635207832

Full record: https://drains.watch/i/permit-phishing-440k-usdc-dec-2025 · JSON: https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.