Permit phishing
Permit phishing tricks a wallet owner into signing an off-chain EIP-2612 permit message that authorises the attacker to spend the owner's tokens.
How it works
A permit is a typed-data signature (EIP-712) rather than a transaction, so signing it costs no gas and many wallets show it as a harmless message. It contains the spender, the amount and a deadline.
Once the attacker has the signature, any account can submit it on-chain together with a transfer, and the tokens move without a further prompt to the victim.
Example from the PhishDestroy database
- x0protocol.ink: Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-21.
- app-changelly.net: Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-12.
- changelly-eng.com: Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-12.
How to protect yourself
- Treat typed-data signatures as seriously as transactions: check the spender, the token and the amount before signing.
- Decline permits requested by a site you reached through an ad, a DM or a search result.