{
 "tag": "link",
 "name": "Link",
 "group": "Other",
 "incidents": [
  {
   "slug": "permit2-phishing-link-167k-oct-2026",
   "title": "Old Permit2 phishing approval used to drain $167K in LINK",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026",
   "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum LINK holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit2",
    "signature-phishing",
    "dormant-approval",
    "link",
    "scam-sniffer"
   ],
   "amountUsd": 167342,
   "victims": 1,
   "startedAt": "2026-10-03",
   "closedAt": null,
   "updatedAt": "2026-10-04T12:00:00Z",
   "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now."
  }
 ],
 "changes": [
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  }
 ]
}