You checked the on-chain records and found that your wallet's assets were moved, but your address never initiated any transaction, and there's no gas fee record. This most likely isn't due to a private key leak — it's because you signed an off-chain signature called "Permit2." The unique thing about this signature is that it doesn't generate any on-chain transaction records, yet it gives someone else a legal proof to take your assets.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 1: Understand Why Permit2 Signatures Leave "No Trace"
Permit2 is a token approval standard launched by Uniswap in late 2022, designed to improve the traditional ERC20 approval experience. The core logic is: you only need to do one on-chain approval for the Permit2 contract, and after that, every interaction only requires an "off-chain signature" (no gas fee). The Permit2 contract verifies the signature and uses transferFrom to move the tokens.
The off-chain signature itself never goes on-chain, so you won't see any record of this signed message on Etherscan or BscScan. But once someone submits that signature on-chain, the Permit2 contract can "use your signature" to call transferFrom and transfer the funds to the address specified in the signature. This is the root reason why "there is no transaction record in the wallet, yet the assets are moved."
Completion standard: You can tell the difference between "approval phishing (needs an on-chain approve transaction, has a gas fee record)" and "Permit2 signature phishing (no on-chain record, just a signature)" — these are two different attack methods.
Step 2: Check If You Are Exposed to Risk
Permit2 phishing only works if your wallet has already given on-chain approval to the Permit2 contract, and the approval amount is usually unlimited (type(uint256).max).
Who might be affected: Any address that has interacted with Uniswap or DApps that integrate Permit2 (like PancakeSwap) after 2023 may have already approved the Permit2 contract. Each time you swap on Uniswap, the system defaults to asking you to approve your full token balance; most people click "Max" or accept the default.
How to check: Use an approval management tool like Revoke.cash. Connect your wallet and look for any approval given to the Permit2 contract (
0x000000000022d473030f116ddee9f6b43ac78ba3), and check if the allowance is "Unlimited".
Common reason for failure: Many people see no transfer record in their wallet and assume it's an exchange or wallet issue. The real problem dates back months or even a year — you approved unlimited allowance, then recently signed a Permit2 signature on a phishing site. The hacker obtained the signature and immediately moved the assets.
High risk: Permit2 phishing started scaling up actively in early 2024. Some attackers specifically scan old on-chain approvals and wait for the right moment. A typical case: a user signed a phishing signature 34 days earlier. At first only a small amount was moved, but he didn't realize the problem and didn't revoke the approval. 30 minutes later, $162,000 was fully drained. Another user lost $1 million because of a single signature.
Step 3: Revoke Permit2 Approvals to Close the Risk Exposure
If you find you have an unlimited approval to the Permit2 contract, perform the revocation:
Method A (recommended): Open Revoke.cash, connect your wallet, find the approval entry for the Permit2 contract, and click "Revoke" or "Update" to set the allowance to 0 or set the expiration to the current block. The revocation is an on-chain transaction and will cost gas.
Method B: Directly call the Permit2 contract's
approvefunction and set the allowance to 0.
Completion standard: After the revocation transaction is confirmed on-chain, check again with Revoke.cash to confirm that the Permit2 allowance has been reset to zero.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 4: Build a Daily Habit of "Signature Security"
Learn to recognize Permit2 signature contents: A Permit2 signature typically includes fields like
Owner(your address),Spender(the authorized party, possibly a hacker address),Value(amount approved), andDeadline(validity period). If you see a signature request containing these fields but you haven't initiated a swap on the official Uniswap or another trusted DApp, reject it immediately.Separate interaction wallet from asset wallet: Keep a small wallet for everyday on-chain interactions and do not keep large amounts in it. Store large assets in a cold wallet or another wallet that has never been connected to unfamiliar websites.
Check approvals regularly: Use Revoke.cash once a month to scan all your wallets and clean up unnecessary approvals.
Verification after completing the steps: After revoking, check the block explorer to see the revocation transaction (on-chain record) you initiated, and confirm its status is Success. If you previously received a Permit2 signature request from a phishing site but aren't sure whether you signed it, proceed directly with Step 3 and revoke the approval — this is the most thorough defense.
