Two recent cases show signatures granted more than a year earlier enabled theft of crypto assets using address spoofing and malicious approvals.

Details of incidents

A user lost $305 000 in DAI after the attacker sent tiny test transfers from a lookalike wallet and replaced the intended address.

Separately, another user lost $167 000 in LINK after a phishing attack exploited a Permit2 approval signed more than one year earlier.

How the attacks worked

Attackers relied on user habits such as copying recipient addresses from transaction histories and trusting old on-chain approvals without rechecking parameters.

In the address substitution case the attacker used dusting transactions to create similarity and lure the victim into pasting the malicious address.

In the Permit2 incident the approval granted broad transfer rights which remained valid and were later invoked by a malicious contract.

Risk reduction measures

• Do not copy recipient addresses from transaction histories; always obtain addresses from trusted sources or verify them manually before sending any funds.
• Check the full destination address, not only the initial and final characters displayed in wallets or wallet interfaces.
• Before large transfers make a small test transfer to confirm the recipient and routing behave as expected in practice on-chain.
• Review and revoke unnecessary approvals, especially long-lived signatures like Permit2, and limit allowance to specific tokens and amounts wherever possible.

Even if funds remain after a suspicious signature, that does not guarantee future safety because approvals can be exploited later.

Users should audit their on-chain permissions periodically and adopt hardware wallets or multisig arrangements for large holdings to reduce single-point failures.