Revenue (X Money to crypto): USDG permit signatures turned into drains
news 05 Oct): Salus flagged users of Revenue, a no-KYC bridge from X Money balances to crypto, signing USDG permit messages that attackers submitted as unlimited spend rights, then transferFrom in the same transaction.
Stolen funds split 20/80 across two addresses, which Salus compares to drainer-as-a-service revenue share. Revenue is not affiliated with X.
The project reported a social-account compromise on 01 Oct and paused swaps; a REV token was then promoted amid conflicting messages. No total loss figure has been published. news and Lookonchain citing Salus.
369 take
Permit signatures can empty a token without a seed and without a second on-chain approve click.
Pulse lesson: read what a signature says it spends; never sign permit or unlimited allowance prompts from a money-to-crypto helper you found in a DM or an X Money pitch.
Sources