{
 "tag": "signature-phishing",
 "name": "Signature Phishing",
 "group": "Other",
 "incidents": [
  {
   "slug": "permit2-phishing-link-167k-oct-2026",
   "title": "Old Permit2 phishing approval used to drain $167K in LINK",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026",
   "json": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum LINK holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit2",
    "signature-phishing",
    "dormant-approval",
    "link",
    "scam-sniffer"
   ],
   "amountUsd": 167342,
   "victims": 1,
   "startedAt": "2026-10-03",
   "closedAt": null,
   "updatedAt": "2026-10-04T12:00:00Z",
   "summary": "Scam Sniffer flagged a user who lost $167,342 in LINK on Ethereum when an attacker used a phishing approval targeting Permit2 to move the tokens on 3 October 2026. The victim had signed the approval long before (Incrypted dates it to 18 August 2025), which shows a malicious approval can sit unused for weeks or months before the drain. Anyone who has signed unfamiliar approvals should review and revoke them now."
  },
  {
   "slug": "bonk-fun-domain-hijack-drainer-mar-2026",
   "title": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026",
   "json": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "front-end-hijack",
   "product": "Bonk.fun launchpad users",
   "tags": [
    "solana",
    "front-end-hijack",
    "bonk-fun",
    "launchpad",
    "domain-hijack",
    "fake-tos",
    "signature-phishing",
    "bonk"
   ],
   "amountUsd": 30000,
   "victims": null,
   "startedAt": "2026-03-11",
   "closedAt": "2026-03-12",
   "updatedAt": "2026-03-12T12:00:00Z",
   "summary": "On Mar 11, 2026, attackers who had hijacked a Bonk.fun team account put a wallet drainer on the Solana launchpad's official domain. Visitors were asked to sign a fake terms-of-service message, and those who signed had their wallets drained. The team called losses minimal; SlowMist's database puts them at about $30,000. Only people who signed the fake message on the domain after the hijack were affected. If you signed it, move remaining funds to a new wallet."
  },
  {
   "slug": "permit-phishing-440k-usdc-dec-2025",
   "title": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025",
   "json": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Ethereum USDC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "erc-2612",
    "usdc",
    "scam-sniffer",
    "signature-phishing"
   ],
   "amountUsd": 440358,
   "victims": 1,
   "startedAt": "2025-12-08",
   "closedAt": "2025-12-08",
   "updatedAt": "2025-12-09T12:00:00Z",
   "summary": "An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions."
  },
  {
   "slug": "solana-owner-permission-phishing-3m-dec-2025",
   "title": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025",
   "json": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "token-owner-swap",
   "product": "Solana wallet user (single victim)",
   "tags": [
    "solana",
    "token-owner-swap",
    "owner-permission",
    "assign",
    "setauthority",
    "simulation-blind-spot",
    "okx-wallet",
    "phantom",
    "slowmist",
    "signature-phishing",
    "account-takeover",
    "misttrack",
    "whale"
   ],
   "amountUsd": 3000000,
   "victims": 1,
   "startedAt": "2025-12-05",
   "closedAt": null,
   "updatedAt": "2026-10-22T20:36:38.517Z",
   "summary": "A Solana wallet user signed a transaction from a disguised tool site that showed no balance change but moved the account's Owner permission to an attacker address starting GKJBEL. SlowMist reported over $3M lost, with about $2M in DeFi positions later recovered with protocol help. On 7 Jan 2026 OKX Wallet warned the technique was spreading across Solana, said it had added pre-signing warnings, and said Phantom had added similar alerts. Before signing, check for any instruction that changes an account owner or authority; normal wallets never ask you to change your own account's owner."
  }
 ],
 "changes": [
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "Scam Sniffer flagged the loss and PANews relayed it.",
   "sourceUrl": "https://panews.io/articles/01a104dd-b676-7729-94be-e34e3f55de72",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "permit2-phishing-link-167k-oct-2026",
   "incidentTitle": "Old Permit2 phishing approval used to drain $167K in LINK",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-03",
   "title": "The attacker used the victim's old Permit2 phishing approval to move $167,342 in LINK.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/permit2-phishing-link-167k-oct-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-12",
   "title": "The Block reported the team told users not to interact with the website until it was secured; the operator said losses were minimal.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "bonk-fun-domain-hijack-drainer-mar-2026",
   "incidentTitle": "Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt",
   "severity": "high",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-03-11",
   "title": "Bonk.fun's official domain began serving a drainer behind a fake terms-of-service signature after a team account was hijacked.",
   "sourceUrl": "https://www.theblock.co/post/393345/bonk-fun-hijacked",
   "url": "https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-01-07",
   "title": "OKX Wallet warns the owner-modification phishing technique is spreading on Solana and says it has added warnings; Phantom reportedly added similar alerts.",
   "sourceUrl": "https://coinfomania.com/okx-wallet-warns-of-new-phishing-scam-targeting-solana-users/",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-09",
   "title": "Decrypt covers the case and explains how permit scams let attackers spend tokens without an on-chain approval.",
   "sourceUrl": "https://decrypt.co/351651/what-a-440000-hack-shows-about-the-rising-threat-of-ethereum-permit-scams",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "permit-phishing-440k-usdc-dec-2025",
   "incidentTitle": "Ethereum user loses $440K in USDC after signing a malicious permit",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-08",
   "title": "Scam Sniffer reports a user lost $440,358 in USDC after signing a malicious permit signature.",
   "sourceUrl": "https://x.com/realScamSniffer/status/1998018496635207832",
   "url": "https://drains.watch/i/permit-phishing-440k-usdc-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "SlowMist warns that a Solana phishing signature moved a victim's account Owner permission to an attacker, with over $3M lost.",
   "sourceUrl": "https://x.com/SlowMist_Team/status/1996528328061382860",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  },
  {
   "incident": "solana-owner-permission-phishing-3m-dec-2025",
   "incidentTitle": "Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2025-12-05",
   "title": "Coinpaper, citing SlowMist, reported a Solana user lost over $3M after a deceptive signature changed the wallet's Owner permission; protocol teams helped recover about $2M in DeFi assets.",
   "sourceUrl": "https://coinpaper.com/12892/solana-user-loses-3-m-as-hidden-wallet-permissions-exploited",
   "url": "https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025"
  }
 ]
}