Orbit

DeFi

when

A recent cyberattack has led to an unsuspecting crypto investor reportedly losing 15,079 fwdETH, worth roughly $36 million.
In the incident, described by security experts as a permit phishing scam, the bad actor tricked the user into unknowingly signing a malicious signature, which gave the thief full access to the individual’s funds.
<h2 id="how-it-happened">How it Happened</h2>
Scam Sniffer, a Web3 anti-scam platform, broke the news in an October 11 <a href="https://x.com/realScamSniffer/status/1844590237521203610" target="_blank" rel="noopener noreferrer nofollow" data-wpel-link="external">post</a> on X, sharing the addresses of the victim and the attacker.
Five hours before the report surfaced, the victim, identified by the address 0xeab23c1e3776fad145e2e3dc56bcf739f6e0a393, signed a permit phishing signature, unknowingly authorizing the hacker to move their 15,079 fwdETH.
The exploiter, linked to the address 0x0605edee6a8b8b553cae09abe83b2ebeb75516ec, immediately sold the tokens on the market, apparently causing the price of dETH, a related asset, to crash by over 90% within 24 hours.
Chiming in on the incident, analyst roffett.eth <a href="https://x.com/roffett_eth/status/1844585497626394774" target="_blank" rel="noopener noreferrer nofollow" data-wpel-link="external">warned</a> that the drop in the price of dETH had affected several decentralized finance (DeFi) protocols, particularly PAC Finance and Orbit Finance since the sell-off had allegedly triggered vulnerabilities in their systems.
<h2 id="the-ripple-effect-on-defi">The Ripple Effect on DeFi</h2>
Permit phishing is still relatively new in crypto circles. It comes from criminals exploiting a requirement in certain DeFi tokens or contracts for the user to approve so-called permit signatures that grant third parties the ability to interact with their wallets, including spending or transferring funds.
Attackers usually create a fake website or interface that looks like a legitimate service or decentralized application (dApp) and then ask users to sign the “permit” transaction. This is often disguised as a legitimate request, tricking users into granting full access to their assets.
Such hacks exploit a lack of understanding around transaction permissions, allowing hackers to drain assets from even well-versed crypto users.
This isn’t the first time DeFi users have been targeted by phishing schemes. According to Scam Sniffer, something similar happened just 12 days earlier, with the victim in that <a href="https://cryptopotato.com/over-20-crypto-hacks-in-september-2024-heres-how-much-was-stolen/#:~:text=%2432.4%20million%20worth%20of%20spark%20wrapped%20ethereum%20(spweth)%20drained%20in%20a%20phishing%20attack%20on%20september%2027." target="_blank" rel="noopener noreferrer nofollow" data-wpel-link="internal">incident</a> losing 12,083 spWETH, which was then valued at about $32 million.
Due to the growing instances of such attacks, experts are urging users to be extra cautious when interacting with unfamiliar links or signing transaction permissions.
“Always double-check any signatures you’re asked to sign, and avoid clicking on unknown links,” Scam Sniffer posted as a reminder to the crypto community of the constant threat of phishing tricks.
The post <a href="https://cryptopotato.com/crypto-investor-loses-36m-to-permit-phishing-scheme/" rel="noopener noreferrer nofollow">Crypto Investor Loses $36M to Permit Phishing Scheme</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Crypto Investor Loses $36M to Permit Phishing Scheme

Table of Contents

CryptoPotato_News

Other articles published on Oct 11, 2024

South Korea may accept spot Bitcoin ETFs? Know what’s going on

Venezuela Sees Record Growth in Cryptocurrency Adoption Amid Political Turmoil

Uniswap Labs Introduces Ethereum Layer-2, Unichain, to Address Scalability Issues

Thai SEC Proposes Rules Allowing Mutual and Private Funds to Invest in Digital Assets

Taisu Ventures and Movement Labs Announce Strategic Partnership to Drive Web3 Ecosystem Growth Ac...

Christie’s sells it’s first Bitcoin Ordinal made by Ryan Koopmans and Alice Wexell

Join our free newsletter for daily crypto updates!