Permit and Permit2 signature phishing
3 incidents, 1 live. 19 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
2 drains in 2026
1 drains in 2025
Live
-
High✕Still active
Old Permit2 phishing approval used to drain $167K in LINK
Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now.
An Ethereum LINK holder·Ethereum·$167K stolen·Since Oct 3, 2026·
Past
January 2026 1
-
Critical✓Contained
User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature
A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.
An Aave aEthLBTC holder·Ethereum·$1.1M stolen·Since Jan 3, 2026·
December 2025 1
-
High✓Contained
Ethereum user loses $440K in USDC after signing a malicious permit
An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.
An Ethereum USDC holder·Ethereum·$440K stolen·Since Dec 8, 2025·
No drains match these filters.