{
 "tag": "permit2",
 "name": "Permit2",
 "group": "Other",
 "incidents": [
  {
   "slug": "permit2-phishing-link-167k-oct-2026",
   "title": "Old Permit2 phishing approval used to drain $167K in LINK",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026",
   "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum LINK holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit2",
    "signature-phishing",
    "dormant-approval",
    "link",
    "scam-sniffer"
   ],
   "amountUsd": 167342,
   "victims": 1,
   "startedAt": "2026-10-03",
   "closedAt": null,
   "updatedAt": "2026-10-04T12:00:00Z",
   "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now."
  },
  {
   "slug": "inferno-angelferno-drainer-still-active-oct-2026",
   "title": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026",
   "json": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "inferno-drainer",
    "angel-drainer",
    "angelferno",
    "purple-drainer",
    "permit2",
    "cloudflare-workers",
    "ransom-isac"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-01",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days."
  }
 ],
 "changes": [
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Ransom-ISAC publishes 'Inferno Drainer Is Burning Out', describing the ecosystem as still active.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-05-01",
   "title": "A key rotation locks the operators out of their own command contract for about 23 days (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-04-14",
   "title": "CoW Protocol domain takeover (April 2026; see cow-swap-dns-hijack-apr-2026), which the report links to the Inferno ecosystem, costs users about $1.2M over about 4.5 hours.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-03-01",
   "title": "AngelFerno announces it has acquired Purple Drainer (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  }
 ]
}