{
 "tag": "atoken",
 "name": "Atoken",
 "group": "Other",
 "incidents": [
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  }
 ],
 "changes": [
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  }
 ]
}