The victim unknowingly signed a fraudulent "permit" signature, allowing the attacker to drain funds from their wallet.