incident 2026-10-28
DrainersAnatomy of a permit drainer
Between 09:12 and 15:20 UTC, 412 wallets signed a message that looked like a login. It was a Permit2 signature for every USDC they held. No transaction was sent by the victims, so no wallet showed a fee or a warning.
timeline utc
Six hours, minute by minute
- 09:12A post from a hijacked project account links to a claim page.
- 09:40The first wallet signs. The page asks for a free signature to check eligibility.
- 10:05The attacker submits the first permit and moves 18,400 USDC.
- 12:30Signatures arrive every 40 seconds. Funds are bridged out in batches.
- 15:20The account is recovered and the post is deleted. 1.9M USDC is gone.
The page never asked for a transaction. It asked for a typed signature, and most wallets show those as a block of text that nobody reads.
Permit2 lets one signature approve a token for a spender until a deadline. This one set the deadline to the year 2106 and the amount to the maximum.
what a check would have shown
The same request, read by Presign
- Permit2 signature, not a login
- Unlimited USDC until 2106
- Spender deployed 2 hours earlier
app.swapzone.exampleethereum · mainnet
3 flags03 / flagsapprove(spender, amount)
- Unlimited allowanceThe spender can move every USDC you hold, now or later.
- New contractThe spender was deployed 3 days ago.
- Unverified sourceIts code is not published, so nobody can read it.
If a site asks you to sign something that is not a transaction, it is still a transaction. It just runs later.
