Trader Loses $1.08M in Aave Token After Phishing Permit Signature
Multiple reports and on-chain analysis from ScamSniffer say a trader lost roughly $1.08 million in aEthLBTC — a tokenized Bitcoin asset on Aave — after signing a malicious “permit” signature on Jan. 3, 2026. The permit appears to have granted the attacker approval to move the tokens without additional confirmations, enabling a swift drain once the signature was executed.
The incident highlights the growing sophistication of phishing that targets off-chain signature flows and DeFi permit standards, which can bypass ordinary approval prompts. Users should treat unexpected signature requests with extreme caution, verify contract addresses and sources, and consider revoking unknown approvals via trusted on-chain tools. The case is being tracked on-chain and underscores persistent risks around permissioned token standards in the DeFi ecosystem.