Image Credit: Shutterstock
- Revenue users have been targeted through malicious permit signatures that gave attackers unlimited approval to spend their USDG before draining connected wallets.
- Blockchain security firm Salus disclosed on Oct. 4 that stolen funds were split 20 percent and 80 percent between two attacker addresses.
- Salus has not published a total loss figure, leaving the scale of the reported USDG wallet drains unclear.
Revenue users have been targeted through malicious permit signatures that gave attackers unlimited approval to spend their USDG before draining tokens from connected wallets.
Blockchain security firm Salus disclosed the activity on Oct. 4. The firm has not published a total loss figure, leaving the scale of the reported thefts unclear.
Permit Signatures Gave Attackers Unlimited USDG Spending Access
Salus said attackers obtained permit signatures from users and submitted them to authorize unlimited spending of their USDG.
The attacker then used transferFrom to move tokens from affected wallets. The approval and transfer occurred within the same transaction, meaning the attacker did not need a victim’s private key after obtaining a valid spending signature.
Permit signatures allow token holders to approve spending without first sending a separate on-chain approval transaction. Salus said the signed permissions were instead used to authorize the wallet drains.
Stolen Funds Were Split 20/80 Between Two Attacker Addresses
Funds removed through the transactions were divided between two attacker-controlled addresses, with 20% routed to one and 80% to the other.
Salus said the split resembled the revenue-sharing structure used by Inferno, a drainer-as-a-service operation that provides phishing infrastructure to affiliates.
The security firm did not establish that Inferno technology was used in the Revenue incidents, and the transaction pattern alone does not confirm a connection.
Revenue Reported Separate Social Media Account Compromise On October 1
Revenue had reported a separate security incident three days earlier, saying someone associated with its moderation operation had compromised control of its social media account.
The project temporarily suspended swaps and warned users that a REV token promoted during the incident was not official.
Revenue markets itself as a service for converting X Money payments into crypto sent to users’ wallets and says it is not affiliated with X or X Money.
The immediate security question remains the scale of the USDG wallet drains. Salus has disclosed the transaction pattern and fund-routing structure, but a verified total for losses affecting Revenue users has not yet been published.
