Salus reported that attackers obtained users’ USDG permit signatures, then immediately called transferFrom after securing unlimited spending permission.

verified span

“Blockchain security firm Salus said attackers obtained permit signatures from users and submitted them to secure unlimited permission to spend their USDG. Once the approval was granted, the perpetrators immediately called the transferFrom function to move the tokens.”