ERC-20 Permit Phishing (2023)
What happened
Two Scam Sniffer reports linked to this entry describe separate ERC-20 permit phishing losses in 2023: approximately $4 million on March 24 and $2.77 million in sfrxETH on August 7. These were wallet-phishing incidents, not a single protocol breach.
Phishing abused ERC-20 permit authorization to spend victims' tokens. The cited reports do not establish a defect in the token contracts or a common attacker across both incidents.
How it happened
- Scam Sniffer reported an approximately $4 million ERC-20 permit phishing loss on March 24 and linked the transaction.
- On August 7, it reported a separate victim losing about $2.77 million in sfrxETH through permit phishing.
- The reports do not establish a shared victim, one attack sequence or recovered funds. The amounts are individual reported estimates, not a verified combined loss.
Protocol details
Post-Incident Timeline
-
2023-08-07
Another victim lost 2,217,982 $USD worth of sfrxETH via ERC20 Permit Phishing attack. Affected Address: Address 0x13c9…cb03 Attacker Addresses: Address 0x000f…0000 Address 0xb1ee…4555 Malicious Transactions: Tx 1 0x7dcd…44c5 Tx 2 0x73aa…36c4
-
2023-07-25
Someone lost 139,000 $USD worth of assets via ERC20 Permit Phishing Affected Address: Address 0x4195…d84f Attacker Addresses: Source Address 0x4bdd…5f2f Funds Transfer Transaction: Tx 0xdf51…08a4
-
2023-08-21
Twitter user @meUP_meQuit lost 846,962 USDC via ERC20-Permit Phishing on Arbitrum chain Victim Address: Address 0x0555…f6cc Scammer Addresses: Address 0x0169…b3a5 Address 0xc049…a45c Funds Transfer Transaction: Tx 1 0xbaad…fd68 Malicious Transaction: Tx 2 0x6a73…570a
-
2023-11-15
Someone lost 1,504,805 aUSDT via Phishing Attack Victim: Address 0xc108…2575 Scammer: Address 0xa730…2896 Malicious Transaction: Tx 0x45cc…d005
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
