Web3 Antivirus detects $563k DeFi loss after phishing approval during Aave and Compound withdrawal

Web3 Antivirus has identified a DeFi incident that resulted in a loss of approximately $563,000 after a user unknowingly approved a malicious token permit while attempting to withdraw funds from Aave and Compound.

According to on-chain analysis by Web3 Antivirus, the affected wallet was created around 209 days prior to the incident and showed relatively limited activity, with just 22 transactions in total. Most of the wallet’s history consisted of deposits into well-known DeFi protocols, including Aave, Compound, and MakerDAO, suggesting routine yield-farming behavior rather than high-risk trading.

Roughly 131 days before the incident, the user deposited about $301,000 USDT into Aave, receiving aEthUSDT in return. Around 73 days later, the user deposited an additional $243,000 USDT into Compound, receiving Compound-issued USDT tokens.

The loss occurred when the user attempted to withdraw funds from these positions. On-chain data indicates that the user first tried to interact with Compound but encountered repeated transaction errors. The user then proceeded to Aave, where a malicious permit approval was granted to an attacker-controlled address. Shortly after the approval, the attacker drained the entire aEthUSDT balance, transferring assets worth approximately $563,778 to a single destination address.

After the initial drain, the user continued interacting with Compound, approving tokens in what appears to have been a planned withdrawal flow. Only afterward did the user attempt to revoke permissions via a token approval management tool, but by that point the primary funds had already been stolen.

Based on the on-chain activity, the incident appears consistent with a phishing scenario in which a deceptive interface was used to capture a malicious approval.

“This case highlights how even experienced DeFi users can lose significant funds through a single malicious approval,” Web3 Antivirus said. “Yield-farming activity often involves repeated interactions across protocols, which makes phishing approvals particularly dangerous when users are focused on completing planned actions”.

 

The incident serves as a reminder that permit signatures and token approvals remain one of the most exploited attack vectors in DeFi, and that losses can occur even when private keys are not compromised.

Web3 Antivirus notes that incidents like this highlight the need for protection at both the user and platform level. For users, this means clear warnings before signing high-risk approvals. For wallets, exchanges, and DeFi platforms, it means monitoring transaction intent and approval behavior in real time to prevent malicious flows before funds move.

As phishing tactics increasingly target routine DeFi actions rather than private keys, pre-transaction detection is becoming a critical layer of defense across the ecosystem.

​​Disclaimer: This content is provided by the sponsor. The statements, views, and opinions expressed in this content are solely those of the content provider and do not necessarily reflect the views of this media platform or its publisher. We do not endorse, verify, or guarantee the accuracy, completeness, or reliability of any information presented. We do not guarantee any claims, statements, or promises made in this article. This content is for informational purposes only and should not be considered financial, investment, or trading advice. Investing in crypto and mining-related opportunities involves significant risks, including the potential loss of capital. It is possible to lose all your capital. These products may not be suitable for everyone, and you should ensure that you understand the risks involved. Seek independent advice if necessary. Speculate only with funds that you can afford to lose. Readers are strongly encouraged to conduct their own research and consult with a qualified financial advisor before making any investment decisions.Neither the media platform nor the publisher shall be held responsible for any fraudulent activities, misrepresentations, or financial losses arising from the content of this press release. In the event of any legal claims or charges against this article, we accept no liability or responsibility. 

Legal Disclaimer: This media platform provides the content of this article on an "as-is" basis, without any warranties or representations of any kind, express or implied. We assume no responsibility for any inaccuracies, errors, or omissions. We do not assume any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information presented herein. Any concerns, complaints, or copyright issues related to this article should be directed to the content provider mentioned above.