{
 "tag": "approval-phishing",
 "name": "Malicious token and NFT approvals",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "usdt-approval-phishing-999999-jul-2026",
   "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026",
   "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "approval-phishing",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "approval-phishing",
    "usdt",
    "scam-sniffer",
    "multicall",
    "drainer"
   ],
   "amountUsd": 999999,
   "victims": 1,
   "startedAt": "2026-07-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance."
  },
  {
   "slug": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "title": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026",
   "json": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "approval-phishing",
   "product": "A crypto wallet holder using a fake exchange site",
   "tags": [
    "multi-evm",
    "approval-phishing",
    "unlimited-approval",
    "fake-exchange",
    "sweeper",
    "phishing"
   ],
   "amountUsd": 1650000,
   "victims": 1,
   "startedAt": "2026-07-03",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise."
  },
  {
   "slug": "cow-swap-dns-hijack-apr-2026",
   "title": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026",
   "json": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "front-end-hijack",
   "product": "CoW Swap (swap.cow.fi) users",
   "tags": [
    "ethereum",
    "front-end-hijack",
    "cow-swap",
    "dns-hijack",
    "registrar",
    "social-engineering",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 1200000,
   "victims": null,
   "startedAt": "2026-04-14",
   "closedAt": "2026-05-13",
   "updatedAt": "2026-05-13T12:00:00Z",
   "summary": "On 14 April 2026 attackers took control of the domain for swap.cow.fi and sent visitors to a cloned CoW Swap interface that asked for malicious token approvals. CoW DAO paused its backend and APIs and told users to revoke approvals made after 14:54 UTC; the protocol's smart contracts were not affected. Early estimates were about $500K drained; Halborn later put user losses at about $1.2M and said the registrar had been social-engineered."
  },
  {
   "slug": "aerodrome-velodrome-dns-hijack-nov-2025",
   "title": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025",
   "json": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "base",
    "optimism"
   ],
   "method": "front-end-hijack",
   "product": "Aerodrome (Base) and Velodrome (Optimism) web app users",
   "tags": [
    "base",
    "optimism",
    "front-end-hijack",
    "aerodrome",
    "velodrome",
    "dns-hijack",
    "eleven-drainer",
    "drainer-as-a-service",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 700000,
   "victims": null,
   "startedAt": "2025-11-21",
   "closedAt": "2025-12-02",
   "updatedAt": "2025-12-02T12:00:00Z",
   "summary": "On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise."
  }
 ],
 "changes": [
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "ForkLog reported the case alongside a separate 999,999 USDT approval-phishing theft, noting the approval gave attackers unlimited access and a sweeper drained the funds.",
   "sourceUrl": "https://forklog.com/en/ethereum-user-loses-nearly-1-million-usdt-in-phishing-scam/",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "fake-exchange-unlimited-approval-1-65m-jul-2026",
   "incidentTitle": "Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-03",
   "title": "An X post by an on-chain commentator reported that a wallet holder lost $1.65M after connecting to a fake exchange and signing a malicious contract.",
   "sourceUrl": "https://x.com/RyanColeXBT/status/2073172860034789620",
   "url": "https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-05-13",
   "title": "Halborn's April review put user losses at about $1.2M and said the DNS registrar had been social-engineered.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-april-2026",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "CoW DAO said swap.cow.fi had been hit by a DNS hijacking, paused its backend and APIs, and told users to stay away from the site.",
   "sourceUrl": "https://cointelegraph.com/news/cow-swap-dao-domain-hijacking",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "cow-swap-dns-hijack-apr-2026",
   "incidentTitle": "CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-04-14",
   "title": "A researcher estimated about $500K drained from a few addresses; CoW DAO told users to revoke all approvals made on CoW Swap after 14:54 UTC.",
   "sourceUrl": "https://decrypt.co/364377/ethereum-defi-exchange-cow-swap-website-compromise",
   "url": "https://drains.watch/i/cow-swap-dns-hijack-apr-2026"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  }
 ]
}