# Signature Phishing · Drain Watch

4 incidents, 2 live. JSON: https://drains.watch/t/signature-phishing.json · RSS: https://drains.watch/t/signature-phishing/feed.xml

- [Old Permit2 phishing approval used to drain $167K in LINK](https://drains.watch/i/permit2-phishing-link-167k-oct-2026) (live, High, Still active, since Oct 3, 2026)
- [Bonk.fun domain hijacked to serve wallet drainer behind fake terms-of-service prompt](https://drains.watch/i/bonk-fun-domain-hijack-drainer-mar-2026) (closed, High, Partly contained, since Mar 11, 2026)
- [Ethereum user loses $440K in USDC after signing a malicious permit](https://drains.watch/i/permit-phishing-440k-usdc-dec-2025) (closed, High, Contained, since Dec 8, 2025)
- [Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss](https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025) (live, Critical, Partly contained, since Dec 5, 2025)