Whale lost more than 6 million USD due to signing a malicious signature

A cryptocurrency whale has suffered over 6 million USD in losses including staked Ethereum (stETH) and Aave-wrapped Bitcoin (aEthWBTC) after unintentionally approving a malicious signature in a phishing attack on September 18, according to blockchain security firm Scam Sniffer.

According to the report, the attacker disguised this action as a normal wallet confirmation step through the “Permit” signature, deceiving the victim into allowing the transfer of assets without revealing warning signs.

Yu Xian, the founder of the security company SlowMist, stated that the victims did not recognize the danger because the transactions did not incur gas fees. He wrote:

“From the victim's perspective, he only clicked a few times to confirm the signature window that popped up from the wallet, without spending a cent on gas fees, and 6.28 million USD vanished.”

How Permit Exploit Works

The “Permit” function is designed to simplify token transfers. Instead of executing an on-chain order and paying gas fees, users can sign an off-chain message to authorize another party.

However, this convenience has opened up a new attack surface for malicious actors. When a victim signs a “permit”, an attacker can combine two functions — Permit and TransferFrom — to withdraw assets directly. Since the authorization occurs off-chain, the wallet dashboard does not display unusual activity until the assets have been withdrawn.

As a result, when transactions are executed on-chain, the entire token has been transferred to the attacker's wallet. This is a loophole that allows Permit exploit to increasingly become a preferred tool for hackers, enabling them to withdraw millions of USD without the need for complex hacking techniques or incurring high gas fees.

Phishing-related losses are increasing

This incident reflects a strong increasing trend in phishing campaigns.

According to Scam Sniffer, in August alone, attackers stole 12.17 million USD from more than 15,200 victims, an increase of 72% compared to July. Notably, nearly half of the losses came from three large wallets, one of which lost 3.08 million USD in a single incident.

The company believes that this increase is primarily due to scams related to EIP-7702 (batch-signature scam) and users inadvertently transferring directly into malicious contracts.

In light of this situation, security experts advise cryptocurrency users to be extremely cautious when signing requests from wallets, especially avoiding granting unlimited access to their assets.

Vương Tiễn