The Whole Revenue Drain Fits in One Transaction, So There Is Nothing to Revoke
Salus says the signed approval and the transferFrom call fit in one transaction. The site is still up.
Revenue users signed USDG permits and attackers used them to secure unlimited permission to spend the tokens, per the security firm Salus[1]. The approval and the transferFrom call that moved the funds ran in the same transaction, leaving little time to react[2]. Funds were split between two attacker-controlled addresses, 20% to one and 80% to the other[3]. Salus published no total loss figure[4] and did not establish that Revenue used Inferno Drainer infrastructure[5]. Revenue’s site stayed reachable after the disclosure, still advertising X Money to crypto conversions[6].
What to do: no revoke step helps here — the approval and the transfer ran in the same transaction[2], and Salus gave users no action to take[4].
Who gains, who loses
Receipts
Salus reported that attackers obtained users’ USDG permit signatures, then immediately called transferFrom after securing unlimited spending permission.
“Blockchain security firm Salus said attackers obtained permit signatures from users and submitted them to secure unlimited permission to spend their USDG. Once the approval was granted, the perpetrators immediately called the transferFrom…”
The Revenue-related approval and transfer occurred within one transaction.
“Both steps were completed within a single transaction, according to the security firm, leaving users with little time to react once their signatures had been submitted.”
Stolen funds from the Revenue-related transactions were divided between two attacker-controlled addresses, with 20% sent to one address and 80% to the other.
“Funds taken through the transactions were then divided between two addresses controlled by the attackers, with 20% sent to one address and 80% to another.”
The security firm had not publicly established a total loss figure for the Revenue-related transactions.
“The security firm has not publicly established a total loss figure for the Revenue related transactions in the information available so far.”
Salus did not establish that Revenue used Inferno Drainer infrastructure.
“Salus did not establish that Revenue was using Inferno Drainer itself, and the similarities cited by the firm do not by themselves confirm that the two operations shared infrastructure.”
The Revenue website remained accessible after Salus disclosed the alleged malicious approvals.
“Revenue's website remained accessible following the security firm's disclosure and continued advertising X Money to crypto conversions when checked.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.