{
 "tag": "aave",
 "name": "Aave",
 "group": "Other",
 "incidents": [
  {
   "slug": "whale-wallet-25m-drain-aug-2026",
   "title": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026",
   "json": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "Unidentified Ethereum whale wallet",
   "tags": [
    "ethereum",
    "whale",
    "phishing",
    "aave",
    "awbtc",
    "peckshield",
    "repeat-victim"
   ],
   "amountUsd": 25600000,
   "victims": 1,
   "startedAt": "2026-08-12",
   "closedAt": null,
   "updatedAt": "2026-08-13T12:00:00Z",
   "summary": "On 12 August 2026 an unidentified whale lost about $25.6M, including about $6.3M in aWBTC, $5.1M in DAI, $4.7M in WBTC and $2.6M in ETH, according to PeckShield. Analyst Specter called it a phishing attack and PeckShield called it a hack; the exact method has not been published. The attacker swapped the funds into DAI and ETH across four addresses. The same wallet lost about $24.2M through malicious token approvals in September 2023."
  },
  {
   "slug": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "title": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026",
   "json": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "permit-phishing",
   "product": "An Aave aEthLBTC holder",
   "tags": [
    "ethereum",
    "permit-phishing",
    "permit",
    "aave",
    "lbtc",
    "atoken",
    "tornado-cash",
    "scam-sniffer",
    "slowmist"
   ],
   "amountUsd": 1080000,
   "victims": 1,
   "startedAt": "2026-01-03",
   "closedAt": "2026-01-03",
   "updatedAt": "2026-01-03T12:00:00Z",
   "summary": "A user lost about 12 aEthLBTC (Aave's wrapped LBTC position on Ethereum), worth about $1.08 million, after signing a malicious permit signature, Scam Sniffer flagged on 3 January 2026. The thieves swapped the funds to ETH and sent them through Tornado Cash; SlowMist's founder said the group was not one of the mainstream drainer crews. Holders of Aave aTokens and other permit-enabled tokens should check what they sign and revoke unknown spenders."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  },
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  }
 ],
 "changes": [
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "PeckShield reported the theft and said the stolen aWBTC, DAI, WBTC and ETH were swapped into DAI and ETH and split across four addresses.",
   "sourceUrl": "https://u.today/crypto-hack-drains-256-million-from-unknown-victims",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-13",
   "title": "Specter described the theft as phishing; the same wallet had lost about $24.2M to malicious token approvals in September 2023.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-wallet-25m-drain-aug-2026",
   "incidentTitle": "Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-12",
   "title": "The whale's wallet was drained of about $25.6M in assets.",
   "sourceUrl": "https://www.tronweekly.com/phishing-attack-drains-crypto-whale-wallet/",
   "url": "https://drains.watch/i/whale-wallet-25m-drain-aug-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "permit-phishing-1-08m-aethlbtc-jan-2026",
   "incidentTitle": "User loses $1.08M in Aave LBTC (aEthLBTC) to a malicious permit signature",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-01-03",
   "title": "Scam Sniffer reports a victim lost about $1.08M in aEthLBTC after signing a malicious permit; SlowMist's founder says the funds were swapped to ETH and sent to Tornado Cash.",
   "sourceUrl": "https://www.cryptopolitan.com/phishing-victim-loses-1-08m-malicious-permit/",
   "url": "https://drains.watch/i/permit-phishing-1-08m-aethlbtc-jan-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  }
 ]
}