{
 "tag": "permit",
 "name": "Permit",
 "group": "Other",
 "incidents": [
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  },
  {
   "slug": "permit-phishing-440k-usdc-dec-2025",
   "title": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025",
   "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum USDC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "erc-2612",
    "usdc",
    "scam-sniffer",
    "signature-phishing"
   ],
   "amountUsd": 440358,
   "victims": 1,
   "startedAt": "2025-12-08",
   "closedAt": "2025-12-08",
   "updatedAt": "2025-12-09T12:00:00Z",
   "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions."
  }
 ],
 "changes": [
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  }
 ]
}