Security notes from someone who got drained, #1
What happened
I kept deposit tokens in a hardware wallet. I went to claim an airdrop, landed on a fake site and approved one signature request. Later, every one of those tokens moved to the attacker.
More than two years later I traced it on chain and finally understood what I had signed. It was a permit.
What a permit is
Normally, letting another address move your tokens takes an approve transaction sent from your own wallet. ERC-2612 permit lets that approval happen through a signed message instead. The message holds the owner, the spender, the amount, a nonce and a deadline.
Signing puts nothing on chain. The signature lands on chain only when whoever holds it submits it, at a time they choose. MetaMask’s own guide makes the same point: an off-chain signature can be used by whoever collected it at a time of their choosing.
What my signature said
- Spender: a contract I had never seen.
- Amount: the maximum value, effectively unlimited.
- Deadline: the maximum value, effectively never.
The attacker used my signature to run the permit and took the tokens.
Why I saw nothing
My wallet sent nothing, so my sent history showed nothing. A permit that has only been signed does not appear in on-chain approval lists until someone submits it. That is why approval checkers could not have warned me.
My memory was wrong too. I remembered mid April. It was about four weeks later. I still do not know which site I signed on, or whether my hardware wallet screen showed the fields or just a hash.
The second attack, right after
Shortly after the drain, a strange entry appeared in my history. It looked like a transfer to an address with the same first and last characters as an address I sent to often. That is address poisoning. Copy an address from your history next time and you pay the attacker.
What I did, and what tracing showed
Afterwards I set the remaining approvals to zero and moved my other assets. I have not yet confirmed whether anything was taken from other wallets.
In October 2026 I followed the money. It was swapped, bridged to another chain and pushed into a privacy protocol, where the trail ends. By then it was no longer in a form a stablecoin issuer could freeze. There was no technical path to get it back.
The checklist I built from this
- If a signature or approval request mentions permit, Permit2 or setApprovalForAll, stop.
- Check the spender is an official contract you know. An address you have never seen means no.
- Unlimited amount or no deadline means no.
- If the hardware wallet shows only a hash instead of readable fields, do not sign.
- Open airdrop, claim and wallet verification pages only from official channels, never from search ads or DMs.
- Never claim or connect new sites from the wallet that holds your main funds. Split wallets by job.
- Never copy a send address from your history. Pick it from a saved address book and check every character.
Where I could be wrong
- The hardware wallet was not the problem. It protects your keys, not the signatures you approve.
- No checklist stops every phish. Signing methods keep changing and attacks follow them.
- I never confirmed the site or the exact signing time. Parts of this are reconstructed backward from on-chain data.
Not financial advice. If you have been drained, contact your wallet provider through its official support channel and report it to your local cybercrime authority.
Written 2026-11-04 15:55 KST. BTC about $77,600, ETH about $2,300 (market price at time of writing, rounded).
Sources
- ERC-2612: Permit Extension for EIP-20 Signed Approvals
- MetaMask Support: Signature phishing
- Trust Wallet: What is an Address Poisoning Scam in Crypto?
- My records: hack retrospective and on-chain tracing notes (written 2026-10-02, private)
