# Old Permit2 phishing approval used to drain $167K in LINK

- Severity: High · Status: Still active (live)
- Chains: Ethereum · Method: Permit and Permit2 signature phishing
- Started: Oct 3, 2026 · Last update: Oct 4, 2026 · Reported stolen: $167K · Victims: 1
- Who/what: An Ethereum LINK holder

Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.

## Am I affected?
If you ever signed a Permit2 or 'permit' message, or approved a token, on a site you no longer trust, the attacker may still be able to use it. Approvals do not expire just because time passes.

## What to do now
- Open a token-approval checker (for example revoke.cash or Etherscan's Token Approvals page) for each of your addresses and revoke anything you don't recognise, including Permit2 allowances.
- If tokens are already gone, revoke the remaining approvals first, then move what is left to a fresh address.

## How to avoid this
- Treat any signature request that mentions Permit2, permit, spender, amount or deadline as handing over spending rights.
- Use a wallet or security extension that simulates and explains signatures, and reject anything you cannot read.
- Keep long-term holdings in a separate wallet that never connects to new sites.

## Sources
- Address loses over $167,000 in LINK tokens after signing phishing approval (PANews, 2026-10-04): https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72
- Gli utenti crypto hanno perso 472.000 dollari a causa di indirizzi falsi e firme di phishing (Incrypted, 2026-10-05): https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/

Full record: https://drains.watch/i/permit2-phishing-link-167k-oct-2026 · JSON: https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.