{
 "tag": "drainer",
 "name": "Drainer",
 "group": "Drainer kits & crews",
 "incidents": [
  {
   "slug": "usdt-approval-phishing-999999-jul-2026",
   "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026",
   "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "approval-phishing",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "approval-phishing",
    "usdt",
    "scam-sniffer",
    "multicall",
    "drainer"
   ],
   "amountUsd": 999999,
   "victims": 1,
   "startedAt": "2026-07-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance."
  },
  {
   "slug": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "title": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025",
   "json": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025.json",
   "status": "closed",
   "severity": "medium",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "ai": {
    "role": "ai-lure",
    "note": "Proofpoint says criminals are increasingly using the AI website builder Lovable to create and host phishing sites, and the Aave lure was a Lovable-built app."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "fake-airdrop-site",
   "product": "Aave and other DeFi users receiving fake reward emails",
   "tags": [
    "multi-evm",
    "fake-airdrop-site",
    "aave",
    "lovable",
    "ai-website-builder",
    "email-phishing",
    "sendgrid",
    "wallet-connect",
    "proofpoint",
    "drainer",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2025-06-17",
   "closedAt": "2025-08-20",
   "updatedAt": "2025-08-20T12:00:00Z",
   "summary": "Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published."
  }
 ],
 "changes": [
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-08-20",
   "title": "Proofpoint published its research on Lovable abuse; Lovable said it had removed a phishing cluster and added real-time detection.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  },
  {
   "incident": "lovable-ai-built-aave-phishing-sites-jun-2025",
   "incidentTitle": "Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections",
   "severity": "medium",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2025-06-17",
   "title": "Proofpoint first saw the Aave-themed lure, a Lovable app linked from SendGrid emails.",
   "sourceUrl": "https://www.proofpoint.com/us/blog/threat-insight/cybercriminals-abuse-ai-website-creation-app-phishing",
   "url": "https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025"
  }
 ]
}