{
 "slug": "permit2-phishing-link-167k-oct-2026",
 "title": "Old Permit2 phishing approval used to drain $167K in LINK",
 "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026",
 "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json",
 "status": "live",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "permit-phishing",
 "product": "An Ethereum LINK holder",
 "tags": [
  "ethereum",
  "permit-phishing",
  "permit2",
  "signature-phishing",
  "dormant-approval",
  "link",
  "scam-sniffer"
 ],
 "amountUsd": 167342,
 "victims": 1,
 "startedAt": "2026-10-03",
 "closedAt": null,
 "updatedAt": "2026-10-04T12:00:00Z",
 "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.",
 "timeline": [
  {
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/"
  },
  {
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Address loses over $167,000 in LINK tokens after signing phishing approval",
   "url": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "publisher": "PANews",
   "date": "2026-10-04"
  },
  {
   "kind": "news",
   "title": "Gli utenti crypto hanno perso 472.000 dollari a causa di indirizzi falsi e firme di phishing",
   "url": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "publisher": "Incrypted",
   "date": "2026-10-05"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf you ever signed a Permit2 or 'permit' message, or approved a token, on a site you no longer trust, the attacker may still be able to use it. Approvals do not expire just because time passes.\n\n## What to do now\n- Open a token-approval checker (for example revoke.cash or Etherscan's Token Approvals page) for each of your addresses and revoke anything you don't recognise, including Permit2 allowances.\n- If tokens are already gone, revoke the remaining approvals first, then move what is left to a fresh address.\n\n## How to avoid this\n- Treat any signature request that mentions Permit2, permit, spender, amount or deadline as handing over spending rights.\n- Use a wallet or security extension that simulates and explains signatures, and reject anything you cannot read.\n- Keep long-term holdings in a separate wallet that never connects to new sites.",
 "notes": null,
 "agentBrief": "# Old Permit2 phishing approval used to drain $167K in LINK\n\n- Severity: High · Status: Still active (live)\n- Chains: Ethereum · Method: Permit and Permit2 signature phishing\n- Started: Oct 3, 2026 · Last update: Oct 4, 2026 · Reported stolen: $167K · Victims: 1\n- Who/what: An Ethereum LINK holder\n\nScam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.\n\n## Am I affected?\nIf you ever signed a Permit2 or 'permit' message, or approved a token, on a site you no longer trust, the attacker may still be able to use it. Approvals do not expire just because time passes.\n\n## What to do now\n- Open a token-approval checker (for example revoke.cash or Etherscan's Token Approvals page) for each of your addresses and revoke anything you don't recognise, including Permit2 allowances.\n- If tokens are already gone, revoke the remaining approvals first, then move what is left to a fresh address.\n\n## How to avoid this\n- Treat any signature request that mentions Permit2, permit, spender, amount or deadline as handing over spending rights.\n- Use a wallet or security extension that simulates and explains signatures, and reject anything you cannot read.\n- Keep long-term holdings in a separate wallet that never connects to new sites.\n\n## Sources\n- Address loses over $167,000 in LINK tokens after signing phishing approval (PANews, 2026-10-04): https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72\n- Gli utenti crypto hanno perso 472.000 dollari a causa di indirizzi falsi e firme di phishing (Incrypted, 2026-10-05): https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/\n\nFull record: https://drains.watch/i/permit2-phishing-link-167k-oct-2026 · JSON: https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}