# Malicious token and NFT approvals · Drain Watch

4 incidents, 0 live. JSON: https://drains.watch/t/approval-phishing.json · RSS: https://drains.watch/t/approval-phishing/feed.xml

- [Ethereum user loses 999,999 USDT after signing a phishing token approval](https://drains.watch/i/usdt-approval-phishing-999999-jul-2026) (closed, High, Still active, since Jul 8, 2026)
- [Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange](https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026) (closed, Critical, Still active, since Jul 3, 2026)
- [CoW Swap domain hijacked via registrar social engineering; cloned site drains users through approvals](https://drains.watch/i/cow-swap-dns-hijack-apr-2026) (closed, Critical, Contained, since Apr 14, 2026)
- [Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer](https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025) (closed, Critical, Contained, since Nov 21, 2025)