Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections
Aave and other DeFi users receiving fake reward emails
Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.
Why this severity: Only partly contained, a narrower target.
AI involvement
AI-made lures. Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- Jun 17, 2025
- Closed
- Aug 20, 2025
- Chains
- Multiple EVM chains
Indicators · never visit or send to these
- aave-reward-notification.lovable[.]app
- reward-aave[.]us
What to do now
- Revoke unknown token approvals with a trusted tool such as revoke.cash, opened from your own bookmark.
- If anything was signed or moved, send the rest of your funds to a new wallet.
Stay safe
Am I affected?
If you clicked an 'Aave reward' email in mid-2025 and connected a wallet or signed anything on the page it opened, check your wallet's token approvals and recent transactions.
What to do now
- Revoke unknown token approvals with a trusted tool such as revoke.cash, opened from your own bookmark.
- If anything was signed or moved, send the rest of your funds to a new wallet.
How to avoid this
- Open DeFi apps only from your own bookmark, never from an email link.
- Real protocols do not email you rewards to claim; AI tools now make convincing copies of any site in minutes.
- Read every wallet prompt and reject any approval or signature you did not expect.
Timeline 2
News & write-ups ›1
How this method works
Look-alike pages promise a token airdrop, a reward or a mint. Connecting and signing is the drain. Read about fake airdrop, claim and mint sites →
Follow new drains and updates in your feed reader or Telegram RSS bot.