# Permit phishing

Permit phishing tricks a wallet owner into signing an off-chain EIP-2612 permit message that authorises the attacker to spend the owner's tokens.

## How it works

A permit is a typed-data signature (EIP-712) rather than a transaction, so signing it costs no gas and many wallets show it as a harmless message. It contains the spender, the amount and a deadline.

Once the attacker has the signature, any account can submit it on-chain together with a transfer, and the tokens move without a further prompt to the victim.

## Example from the PhishDestroy database

- [x0protocol.ink](https://phishdestroy.io/domain/x0protocol.ink/): Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-21.
- [app-changelly.net](https://phishdestroy.io/domain/app-changelly.net/): Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-12.
- [changelly-eng.com](https://phishdestroy.io/domain/changelly-eng.com/): Wallet-drainer domain (kits of this family request permits and approvals), first detected 2026-10-12.

## How to protect yourself

- Treat typed-data signatures as seriously as transactions: check the spender, the token and the amount before signing.
- Decline permits requested by a site you reached through an ad, a DM or a search result.

## Related tools

- [Signature Request Inspector](https://phishdestroy.io/developer-tools/sign-inspector)

## Related terms

- [Permit2](https://phishdestroy.io/glossary/permit2/)
- [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/)
- [setApprovalForAll](https://phishdestroy.io/glossary/setapprovalforall/)

## Further reading

- [Crypto Drainer Anatomy: $1.93B Stolen](https://phishdestroy.io/crypto-drainer-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/permit-phishing/