The Authorization Abuse Epidemic: Why Permit2 Signature Phishing Is Now Crypto's Deadliest Attack Vector

Authorization abuse via Permit2 signature phishing has overtaken smart contract exploits as crypto's primary attack vector in early 2026, with a single phishing attack accounting for $282 million (75%) of January losses. The article explains how Permit2's off-chain approval mechanism—originally designed for better UX and lower gas fees—creates an invisible attack surface that social engineering exploits, and discusses defenses for builders and users.