According to PANews, citing Scam Sniffer monitoring, an Ethereum user lost $167,342 worth of LINK after signing a Permit2 phishing approval. The approval was signed as early as August 2025, and the attacker lay dormant for over a year before finally executing the transfer this October.
This is a delayed-burst signature phishing attack. The Permit2 protocol was originally designed to save gas fees and allow offline signature-based approvals. Phishing websites disguise themselves as airdrop or event pages to lure users into signing. Because offline signatures do not incur gas fees and wallets do not deduct funds immediately, victims remain unaware. After obtaining the permission, attackers stay dormant for a long time and only drain the wallet once more assets have been deposited.
For daily operations, please follow these precautions:
1. Refuse blind signing: carefully check the authorized contract and allowance in the wallet pop-up; if you cannot identify it, reject it.
2. Regularly clean up approvals: use tools such as Revoke every month to check and revoke inactive approvals.
3. Separate cold and hot wallets: use a small hot wallet for interactions, and store larger assets in a cold wallet.
4. Stay away from unknown links: never click event pages shared in social media DMs.
On-chain asset security depends on vigilance every time you sign.
Personal views and information roundup only, not investment advice, DYOR.
$LINK #防詐 #資安
This is a delayed-burst signature phishing attack. The Permit2 protocol was originally designed to save gas fees and allow offline signature-based approvals. Phishing websites disguise themselves as airdrop or event pages to lure users into signing. Because offline signatures do not incur gas fees and wallets do not deduct funds immediately, victims remain unaware. After obtaining the permission, attackers stay dormant for a long time and only drain the wallet once more assets have been deposited.
For daily operations, please follow these precautions:
1. Refuse blind signing: carefully check the authorized contract and allowance in the wallet pop-up; if you cannot identify it, reject it.
2. Regularly clean up approvals: use tools such as Revoke every month to check and revoke inactive approvals.
3. Separate cold and hot wallets: use a small hot wallet for interactions, and store larger assets in a cold wallet.
4. Stay away from unknown links: never click event pages shared in social media DMs.
On-chain asset security depends on vigilance every time you sign.
Personal views and information roundup only, not investment advice, DYOR.
$LINK #防詐 #資安