{
 "tag": "permit-phishing",
 "name": "Permit and Permit2 signature phishing",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "permit2-phishing-link-167k-oct-2026",
   "title": "Old Permit2 phishing approval used to drain $167K in LINK",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026",
   "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum LINK holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit2",
    "signature-phishing",
    "dormant-approval",
    "link",
    "scam-sniffer"
   ],
   "amountUsd": 167342,
   "victims": 1,
   "startedAt": "2026-10-03",
   "closedAt": null,
   "updatedAt": "2026-10-04T12:00:00Z",
   "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now."
  },
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  },
  {
   "slug": "permit-phishing-440k-usdc-dec-2025",
   "title": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025",
   "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum USDC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "erc-2612",
    "usdc",
    "scam-sniffer",
    "signature-phishing"
   ],
   "amountUsd": 440358,
   "victims": 1,
   "startedAt": "2025-12-08",
   "closedAt": "2025-12-08",
   "updatedAt": "2025-12-09T12:00:00Z",
   "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions."
  }
 ],
 "changes": [
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  }
 ]
}