Aave phishing attack shocks users after $60b milestone

Aave phishing attack strikes the DeFi world less than 24 hours after the protocol celebrated surpassing $60 billion in net deposits, triggering widespread concern and urgent calls for better investor protection.

The Aave phishing attack, which surfaced immediately after Aave’s record-setting achievement, was executed through malicious Google Ads that impersonated official Aave investment platforms.

According to blockchain security firm PeckShield, the fraudulent links lured unsuspecting users to fake websites designed to drain their crypto wallets once connected.

Aave’s record-breaking week ends in alarm

On Wednesday, Aave proudly declared it had reached a historic milestone: $60 billion in net deposits across 14 blockchains, a feat unmatched in the decentralized finance (DeFi) space.

Token Terminal data reveals this figure had more than tripled from $18 billion in August 2024—a testament to Aave’s explosive growth.

But the celebration didn’t last long. By Thursday morning, cybersecurity experts at PeckShieldAlert took to X (formerly Twitter) to warn of an ongoing Aave phishing attack, stating:

“⚠️ A phishing site is impersonating Aave via Google Ads. Users connecting wallets risk complete fund loss. Stay vigilant.”

The Aave phishing attack gained momentum quickly due to the deceptive nature of the phishing links.

Fraudsters exploited Google Ads to rank fake Aave platforms high in search results, increasing the likelihood of victims clicking the malicious links.

Once users connect their wallets to these imitation websites, attackers can instantly siphon funds, with transactions typically being irreversible on-chain.

Security researcher Chris Blec, a vocal DeFi watchdog, commented:

“This is yet another reminder that Web3 doesn’t forgive mistakes. Connecting your wallet to the wrong site can cost you everything. Double-check URLs—always.”

Investors urged to protect themselves

As the Aave phishing attack continues to circulate, experts are urging investors to follow best practices to secure their assets:

• Verify URLs: Always check the domain name before linking your wallet.

• Use browser bookmarks to access official DeFi sites instead of relying on search engines.

• Revoke token approvals using trusted platforms like Revoke.cash if you suspect compromise.

• Transfer funds immediately from compromised wallets to new, secure ones.

• Never reuse compromised wallets as attackers often monitor them for new activity.

A spokesperson from SlowMist, another reputable blockchain security firm, emphasized:

“These attacks are becoming more sophisticated. Phishing scams now use high-level marketing tools like Google Ads to exploit trust. Education is key to prevention.”

Cointelegraph reached out to Aave Labs for an official response. While no confirmed fund losses have been reported yet, Aave acknowledged awareness of the attack and is collaborating with security partners to minimize impact.

The project also encouraged users to rely on verified channels for communication and updates. A community manager stated on Discord:

“Please avoid clicking any links outside our official website and socials. If you see suspicious ads, report them immediately.”

The growing trend of phishing in deFi

This Aave phishing attack follows a troubling trend in the crypto world. Just in 2025, phishing-related losses have topped $150 million, with attackers leveraging increasingly clever techniques.

“Phishing is now the most effective form of crypto theft,” said Richard Sanders, lead investigator at CipherBlade.

“Google Ads, Twitter impersonations, Discord hacks—these are the new front lines. Aave is just the latest high-profile target.”

The Aave phishing attack serves as a stark reminder that with greater adoption comes greater risk.

While DeFi continues to revolutionize finance, its open and permissionless nature leaves the door open for sophisticated scams.

For Aave, the incident underscores the double-edged sword of success—with growth attracting not only investors but also bad actors. As always in crypto: Don’t trust, Verify.