Aave
4 incidents, 1 live. 71 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
2 drains in 2026
2 drains in 2025
Live
-
Critical✕Still active
Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023
On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023.
Unidentified Ethereum whale wallet·Ethereum·$26M stolen·Since Aug 12, 2026·
Past
January 2026 1
-
Critical✓Contained
User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature
A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders.
An Aave aEthLBTC holder·Ethereum·$1.1M stolen·Since Jan 3, 2026·
November 2025 1
-
Critical✕Still active
Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash
A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.
Private whale's Gnosis Safe multisig (Ethereum)·Ethereum·$27M stolen·Since Nov 4, 2025·
June 2025 1
-
Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections
Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.
Aave and other DeFi users receiving fake reward emails·Multiple EVM chains·Since Jun 17, 2025·
No drains match these filters.