Ethereum Wallet Drained of $440K USDC After Malicious Permit Signature
A single Ethereum address was drained of 440,358 USDC after the user signed a malicious permit request, according to reports. By approving a forged permit signature, the victim effectively granted an attacker the right to transfer stablecoins directly, bypassing the usual on-chain allowance confirmation — a technique increasingly used in targeted phishing campaigns.
The theft underscores a growing pattern of permit-based exploits and social‑engineering attacks that put DeFi users and custodial services at risk. Beyond the immediate loss, the incident raises concerns about wallet UI clarity and the safety of off‑chain signature approvals. Users and platforms should be aware of unexpected signature prompts and review how wallets present permit requests, as attackers continue to evolve strategies that exploit signature flows across dApps and exchanges.