Phishing Scam Costs DeFi User $35M

The decentralized finance (DeFi) sector is offering a new way to trade without intermediaries. However, this approach also brings serious risks

A recent phishing attack cost one user $35 million, showcasing the vulnerabilities in the DeFi ecosystem.

On Friday, October 11, on-chain data revealed one of the largest losses in DeFi due to phishing scams. After approving a fraudulent permit signature, a DeFi user lost 15,079 fwDETH tokens, valued at $35 million.

? 5 hours ago, someone lost 15,079 fwDETH($35M) after signing a "permit" phishing signature.

According to online investigators, the phishing attack utilized the permit signature function. This feature, designed to facilitate token transfers, also enables attackers to swiftly drain user wallets.

TL;DR: An unknown suspicious address obtained tens of thousands of fwdETH through the permit method and sold them, causing the price of dETH to plummet rapidly, leading to attacks on protocols like PAC Finance and Orbit Finance.

https://t.co/FwsGhSfs0q

">@RingProtocol…

The stolen tokens were then quickly sold on decentralized exchanges. The substantial volume and selling pressure even resulted in a sharp decline in dETH price on DeFi platforms PAC Finance and Orbit Finance.

To safeguard against phishing scams, users are advised to adhere to several crucial practices:

Double-Check Permissions: Prior to signing any signature approvals, thoroughly review the transaction details. Phishing attacks capitalize on users' tendency to trust signature approvals posted online. In DeFi, the stakes of these approvals are particularly high.

Use Reputable Wallets: Many wallets integrate built-in security features to help prevent common scams and exploits.

Enable Multi-Factor Authentication (MFA): MFA adds an extra layer of protection to transactions. When enabled, even if an attacker manages to trick a user into signing, they still need to clear additional security checks.

Safe Browsing and Email Use: Refrain from responding to any unsolicited emails, especially those urging users to click on links. Always verify the sender's email to identify any attempts to impersonate legitimate entities.