Old Permit2 phishing approval used to drain $167K in LINK
An Ethereum LINK holder
Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.
Why this severity: $167K reported stolen, 1 victims, still active.
- Started
- Oct 3, 2026
- Chains
- Ethereum
- Reported stolen
- $167K
- Victims
- 1
At risk
- An Ethereum LINK holder
- Ethereum wallets
What to do now
- Open a token-approval checker (for example revoke.cash or Etherscan's Token Approvals page) for each of your addresses and revoke anything you don't recognise, including Permit2 allowances.
- If tokens are already gone, revoke the remaining approvals first, then move what is left to a fresh address.
Stay safe
Am I affected?
If you ever signed a Permit2 or 'permit' message, or approved a token, on a site you no longer trust, the attacker may still be able to use it. Approvals do not expire just because time passes.
What to do now
- Open a token-approval checker (for example revoke.cash or Etherscan's Token Approvals page) for each of your addresses and revoke anything you don't recognise, including Permit2 allowances.
- If tokens are already gone, revoke the remaining approvals first, then move what is left to a fresh address.
How to avoid this
- Treat any signature request that mentions Permit2, permit, spender, amount or deadline as handing over spending rights.
- Use a wallet or security extension that simulates and explains signatures, and reject anything you cannot read.
- Keep long-term holdings in a separate wallet that never connects to new sites.
Timeline 2
News & write-ups ›2
How this method works
You sign what looks like a harmless login message, but it is an off-chain permission that lets the attacker move your tokens. No gas, no transaction, so it feels safe. Read about permit and permit2 signature phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.