Malicious token and NFT approvals
4 incidents, 0 live. 106 days since the last new one.
4 drains in the last 12 months
4 drains in the last 12 months
3 drains in 2026
1 drains in 2025
Past
July 2026 2
-
High✕Still active
Ethereum user loses 999,999 USDT after signing a phishing token approval
On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance.
Ethereum USDT holder·Ethereum·$1000K stolen·Since Jul 8, 2026·
-
Critical✕Still active
Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange
In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.
A crypto wallet holder using a fake exchange site·Multiple EVM chains·$1.6M stolen·Since Jul 3, 2026·
April 2026 1
-
Critical✓Contained
CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals
On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered.
CoW Swap (swap.cow.fi) users·Ethereum·$1.2M stolen·Since Apr 14, 2026·
November 2025 1
-
Critical✓Contained
Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Aerodrome (Base) and Velodrome (Optimism) web app users·Base, Optimism·$700K stolen·Since Nov 21, 2025·
No drains match these filters.