$1.77M USDC drained after victim signs phishing permit signature on Ethereum, exposing how gasless approvals are becoming a major attack vector