The largest theft was caused by a user signing a malicious ‘permit’ transaction, allowing the scammer to steal 211 stETH worth $654K.