Permit and Permit2 signature phishing
You sign what looks like a harmless login message, but it is an off-chain permission that lets the attacker move your tokens. No gas, no transaction, so it feels safe.
How it works
Many ERC-20 tokens support permit (EIP-2612), and Uniswap's Permit2 contract lets almost any token be approved the same way: by signing a typed message instead of sending an approval transaction. The signature says which address may spend your tokens, how much, and until when.
A drainer site asks you to 'verify your wallet', 'claim an airdrop' or 'sign in'. The request is really a Permit or Permit2 message naming the attacker as the spender for an unlimited amount. Because it is only a signature, your wallet shows no gas fee and nothing leaves your wallet straight away.
Seconds later the attacker submits that signature on chain and sweeps every token it covers. Stablecoins and staked tokens are favourite targets.
Red flags
- A 'sign in' or 'verify' prompt that shows token names, amounts or an expiry date
- Typed data mentioning Permit, PermitSingle, PermitBatch, spender or nonce
- Free-claim or airdrop pages reached from replies, DMs or ads
- An unlimited amount, or a deadline far in the future
- Any site rushing you: 'claim ends in 10 minutes'
Protect yourself
- Read every signature request; real logins never mention tokens or spenders
- Use a wallet that decodes signatures in plain words (MetaMask's security alerts, Rabby, Blockaid-powered warnings)
- Keep most funds in a separate wallet that never connects to new sites
- Only open claim pages from the project's official site, never from replies or ads
- Review and revoke Permit2 allowances regularly
If you already signed
- Assume every token the signature covered is at risk; move what's left to a fresh wallet now
- Revoke the Permit2 and token approvals with an approval checker
- Report the drainer site to your wallet's phishing team and to Chainabuse
Incidents using it 3
-
High✕Still active
Old Permit2 phishing approval used to drain $167K in LINK
Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.
An Ethereum LINK holder·Ethereum·$167K stolen·Since Oct 3, 2026·
-
Critical✓Contained
User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature
A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.
An Aave aEthLBTC holder·Ethereum·$1.1M stolen·Since Jan 3, 2026·
-
High✓Contained
Ethereum user loses $440K in USDC after signing a malicious permit
An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.
An Ethereum USDC holder·Ethereum·$440K stolen·Since Dec 8, 2025·