Once you hold a well-known crypto token, offers start to arrive: a free balance you never bought, a link to claim a reward, or a stranger who wants to fix your wallet. These impersonation scams are built to look official, and each one is after a wallet signature or your secret recovery phrase.
Holders of AAVE, the governance token of the Aave Protocol, see the same tactics. AAVE is an ERC-20 token on Ethereum that trades on both centralized and decentralized exchanges (source: Aave Docs, AAVE Token). Scammers copy its name onto fake tokens, its app onto fake websites, and its community onto fake support accounts. Every one of those copies fails a few simple checks on the contract address, the website address, and what you are actually asked to sign.
What is a fake AAVE token?
A fake AAVE token is a separate ERC-20 contract that copies the AAVE name, symbol, or logo, so your wallet shows AAVE while the balance sits in a scammer's contract. Anyone can reuse a name and symbol, but no one can reuse a contract address, the most reliable check (source: ethereum.org, How to identify scam tokens).
ERC-20 is the token standard behind AAVE and most other Ethereum tokens. It defines how a contract reports balances, sends tokens, and lets another address spend tokens for you. The name and symbol are optional labels that the contract's author fills in (source: Ethereum Improvement Proposals, EIP-20 Token Standard). Because those labels are free text, a scam contract can give itself the real token's name and ticker and look identical in a wallet's token list.
Scam tokens also fake the signs of a real market. The balances live in the token's own contract storage. That lets its author give large balances to the addresses of real holders of the genuine token, produce fake transfer records, and even stop other holders from moving the token. Liquidity is much harder to fake, because a scammer does not want to put real money into a trading pool. A liquidity pool is the supply of tokens a decentralized exchange (DEX) uses to fill trades. In one documented case, a tiny purchase of a scam token moved its price by more than 90% (source: ethereum.org, How to identify scam tokens).
The usual delivery is an airdrop. A scam project sends the token to your wallet without asking and points you to a website where you can supposedly claim it. The claim step asks you to connect your wallet and approve a transaction that gives the scammer access to your account (source: ethereum.org, Ethereum security and scam prevention). An unexpected AAVE balance is a warning sign. Ignore it, hide it in your wallet if the app allows, and match any token against the list of AAVE networks and contract addresses before you send or swap it.
The real AAVE governance token lets holders vote on Aave Protocol proposals or delegate their voting power to someone else (source: Aave Docs, AAVE Token). Scammers borrow that role as bait, so a fake governance reward or a voting claim deserves the same doubt as a free token.
Phishing sites that copy the Aave app
A phishing site is a copy of the Aave app, or of a fake claim portal, on a domain a scammer controls. It is built to collect a wallet connection, a signature, or your recovery phrase. Because a website's look is easy to copy, a clone can match the real site closely (source: ethereum.org, How to identify scam tokens).
Most people reach a fake site through a link. Phishing emails send readers to imitation websites that ask for a seed phrase, a password reset, or a payment, and some emails try to install malware on the computer as well. Links in posts on X carry the same risk. The link preview can be faked to show a trusted domain while the click goes to a harmful site (source: ethereum.org, Ethereum security and scam prevention). Search ads and Discord messages work the same way, so the address bar after the page loads is the only domain that counts.
The defense is a habit you can repeat each time. Check the full URL of any site before you connect. Save the real addresses as browser bookmarks and open the Aave app only from them. That way a misspelled domain or a forwarded link cannot fool you (source: ethereum.org, How to identify scam tokens). Connecting a wallet shares your address with the site, and the prompts that follow the connection are where the loss happens, so read each one before you approve it.
Fake support emails and spoofed login pages follow the same phishing patterns in crypto that target all wallet and exchange accounts. The Aave-themed versions often promise a reward, a migration, or a fix for a stuck position. Each one asks for a wallet connection on a page you did not open yourself. When an offer arrives that way, close the tab, open your own bookmark, and check whether the same offer appears on the real site.
Giveaway and fake support scams
Giveaway and fake support scams ask you to act first. A giveaway promises to double any crypto you send before a short deadline runs out. A fake support agent offers to fix your wallet once you share your recovery phrase. Giveaways are always scams; real support staff never ask for that phrase (source: ethereum.org, Ethereum security and scam prevention).
A recovery phrase, also called a seed phrase, works as the master key for the whole wallet, because whoever holds it can open each account inside and move all the funds out. Fake support is built to get that phrase. Scammers search public Discord channels for people asking for help and send a private message that offers support. They build trust until the target types the phrase or sends funds, and the same approach shows up in email and other chat apps. Real staff do not contact you through private, unofficial channels. They never need your phrase, your private key, or remote access to your computer (source: ethereum.org, Ethereum security and scam prevention).
Aave-themed versions borrow real events to sound urgent. A message may claim that a rewards season closes tonight, that your supplied funds are stuck until you run a migration, or that a compliance check needs your phrase before your AAVE can be released. The pattern has a well-known precedent on Ethereum itself. Before the network moved to proof of stake, scammers posing as support told people to swap their ETH for an ETH2 token that never existed (source: ethereum.org, Ethereum security and scam prevention).
When something looks wrong with an account, start the conversation yourself. Open the help page of your wallet or exchange from an address you typed, and stay inside that signed-in channel. Share only details that are already public, such as a transaction hash or a screenshot of an error. For a balance you plan to keep, the habits in how to store AAVE safely and the device steps in AAVE wallet setup cut the number of places where a phrase could leak.
Approval drains after you connect a wallet
An approval drain takes your tokens without your recovery phrase. You sign an ERC-20 approval that names a spender, often a contract the scam site controls. From then on, that spender can withdraw tokens from your wallet several times over, up to the amount you approved, without asking you again (source: Ethereum Improvement Proposals, EIP-20 Token Standard).
Scam sites push for the widest approval they can get. Many apps request an unlimited allowance so that you approve once and pay the fee once (source: ethereum.org, Revoke token access). A smart contract with permission to spend your tokens can spend them at any time. If that contract is malicious, it can empty the approved token balance whenever it chooses (source: Revoke.cash, What Are Token Approvals?). Approvals also stay active until you revoke them. An approval you signed years ago on a site you have forgotten can still be used against you today (source: Revoke.cash, How to Revoke Token Approvals and Permissions).
Crypto wallet drainers automate this sequence with a fake claim page, a routine-looking wallet connection, and then an approval request. In your wallet, the function names to watch for are approve for tokens and setApprovalForAll for whole NFT collections (source: Revoke.cash, What Are Token Approvals?). Treat a request to sign a permit message with the same caution. If any of these appears while you only meant to view a page or claim something you never earned, reject it and close the site. When a trusted app does need an approval, set the spend limit to the amount that one action needs (source: ethereum.org, Ethereum security and scam prevention).
Revoking an approval is a transaction of its own. It is worth sending even after a drain, because the same approval could be used again later. Open a revoke tool from a bookmark. On Revoke.cash, enter your wallet address, choose the network, and sort the list from newest to oldest so the approval you signed most recently appears first. On the Token Approvals page of Etherscan, enter your address, pick the token type, and switch on Show all approvals. Then click Revoke next to the spender and confirm the transaction in your wallet. Explorers for other chains, such as Polygonscan, offer the same page for their own network (source: Revoke.cash, How to Revoke Token Approvals and Permissions). Repeat the steps in revoke token approvals on every network where you have used the same wallet.
How to verify the official AAVE contract
The official AAVE token has one contract per network, and Aave publishes each address. On Ethereum the contract is 0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9. Bridged AAVE has a separate address on Arbitrum, Base, Optimism, and Polygon (source: Aave Docs, AAVE Token). A token at any other address is someone else's token, whatever its name says.
Run the check in the same order each time you add a token, send, or swap. Open the Aave docs from a URL you typed or a bookmark, find the network your wallet is set to, and follow the explorer link for that network. On the explorer page, compare the contract address with the one in your wallet character by character, from the first to the last. Ignore any difference between upper and lower case letters. The token name can also differ by network: the bridged token on Polygon appears as Aave (PoS) with its own contract (source: Polygonscan, Aave (PoS) token). The characters of the address are the part you match, whatever the name or the letter case shows.
The common AAVE scam patterns each leave a different trace, and each one has a check that catches it.
| Pattern | What it looks like | How to check |
|---|---|---|
| Fake AAVE token | An unexpected AAVE balance, or a token with the AAVE name and logo | Match the contract address with the one Aave publishes for that network |
| Phishing site | A copy of the Aave app or a claim portal reached through a link | Open the app from your own bookmark and read the full URL |
| Giveaway | A promise to double any crypto you send before a deadline | Send nothing, because giveaways are always scams |
| Fake support | A private message that offers to fix your wallet | Keep your recovery phrase and private key to yourself, and contact support through a channel you opened |
| Approval drain | A claim or reward button that asks you to approve a spender | Read the function name and the spender, reject what you did not plan, and revoke any approval you already signed right away |
Before you sign anything related to AAVE, four questions cover lookalike tokens, cloned sites, phrase requests, and approval drains. Did you type the site address yourself, or did it come from a message, an ad, or a pop-up? Does the token contract match the address that Aave lists for this network? Is the wallet asking for an approve or permit you did not plan to give? Is anyone asking for your recovery phrase? If any answer is wrong, stop and close the site before you sign.
If you would prefer to buy AAVE through an exchange without picking a token contract yourself, an order book is a second route. The exchange lists the market and credits the token to your account. On BloFin that means the AAVE/USDT Spot market for the token itself, or the AAVEUSDT Perpetual, a contract that tracks the AAVE price without delivering any tokens. Before your first order, check the maker and taker rates on the BloFin trading fee schedule. A later withdrawal to your own wallet still needs the network and address match.
What to do after a bad click or a shared phrase
Your next step depends on what you exposed. A shared recovery phrase means the whole wallet is compromised, so move what is left to a new wallet on a clean device. A signed approval gives one spender access, so revoke it first. Speed matters because a transaction sent on Ethereum cannot be reversed (source: ethereum.org, Ethereum security and scam prevention).
After a shared phrase, create the new wallet on a device you trust, write the new phrase on paper, and keep it out of screenshots and cloud notes. Move the largest balances first, and accept that dust, the tiny amounts too small to be worth the network fee, may stay behind. Stop using the old phrase completely, and treat any address it controls as belonging to the scammer from now on.
If you only approved a spender, revoke it right away. Scammers often drain tokens shortly after an approval is signed, which means a revoke that lands in time can stop the loss (source: Revoke.cash, How to Revoke Token Approvals and Permissions). If you installed an app or a browser extension from a scam link, treat the whole device as compromised. Most browser extensions can read and change site data. Because Chrome extensions update on their own, an extension that looked safe can turn malicious later (source: ethereum.org, Ethereum security and scam prevention). Move funds from a different device, and remove the extension before you use that browser for crypto again.
Write down what happened while the details are fresh: the spender address, the transaction hash, the time you signed, and the website or chat account that sent you there. A wallet's activity screen and the block explorer carry most of these details. They will not reverse a completed transfer, but they give an exchange or an investigator something concrete to act on.
Expect a second wave of contact after a loss. Treat any message that offers to recover lost funds for a fee as one more scam attempt, and never hand a new recovery phrase to anyone who asks for it. Then tighten the rest of your setup. Turn on two-factor authentication for any exchange account tied to the same email, and review open approvals on every wallet you still use.
Looking to trade AAVE tokens on BloFin? To get started, you'll need to first create a BloFin account, fund your account with cryptocurrency, then open the AAVE/USDT Spot trading page or the AAVEUSDT Perpetual page.
Frequently asked questions
Why does the AAVE contract address mix upper and lower case letters?
The mixed case is a built-in typo check called an EIP-55 checksum. An Ethereum address has 40 hexadecimal characters after the 0x. The checksum capitalizes some of those letters based on a hash of the address, so a wallet can catch most typos. A random typo passes the check only about 0.0247% of the time. The same address in all lowercase still points to the same account. That is why explorers and token lists sometimes print it in a different case (source: Ethereum Improvement Proposals, EIP-55 Mixed-case checksum address encoding).
What is a permit signature, and how long does it stay valid?
A permit is a signed message that sets a token allowance without a transaction from your wallet, on tokens that support the EIP-2612 standard. Anyone who holds the signed message can submit it to the token contract. Each permit carries a deadline, and that deadline can be set so far ahead that the permit never really expires. A permit you signed on a scam site can be held back and used later. Submitting a newer permit from your own wallet can make earlier signed permits invalid (source: Ethereum Improvement Proposals, EIP-2612 Permit Extension).
Where can you report an AAVE scam in the United States?
In the United States, you can report crypto fraud to the Federal Trade Commission at ReportFraud.ftc.gov, the Commodity Futures Trading Commission, the Securities and Exchange Commission, and the FBI's Internet Crime Complaint Center (IC3). Report it as well to the crypto exchange you used to send the money. Unlike a credit card charge, a crypto payment usually comes with no legal dispute process (source: FTC, What To Know About Cryptocurrency and Scams). A report lets the FBI investigate the crime, track scam trends and, in some cases, freeze stolen funds (source: FBI, Internet Crime Complaint Center).
Does revoking an approval close an Aave supply or borrow position?
Revoking an approval removes a spender's right to move tokens from your wallet and changes nothing else. Your supplied assets, open loans, and rewards in a lending protocol stay as they are, so you can clean up approvals without touching a position. If you cannot tell which spender is the bad one, revoking all of them causes no problems. Each revoke is a transaction with its own network fee, and you grant fresh permissions the next time you use each app (source: ethereum.org, Revoke token access).
What does Etherscan show for the real AAVE token?
Etherscan lists the Ethereum contract under the name Aave Token, with 18 decimals, a maximum total supply of 16,000,000 AAVE, and a Reputation OK label (source: Etherscan, Aave Token (AAVE)). The same page has tabs for transfers, holders, and the contract code, so you can see real activity on the token before you receive or buy it. If the token page you reach shows a different contract or lacks that label, stop before you send anything and go back to the address Aave publishes.
Does checking AAVE approvals on Ethereum cover my other networks?
An Ethereum approval check covers Ethereum contracts only, so you need to review each network where you granted token access. A revoke tool displays permissions for the network selected in both the tool and your wallet. Switching from Ethereum to Polygon, for example, reveals a different set of contracts (source: ethereum.org, Revoke token access). After a suspicious approval, start with the network where you signed it, then review any other networks you have used instead of assuming one clean list covers the whole wallet.
Researched and written by the BloFin Academy editorial team with AI-assisted drafting. Primary sources include Aave token documentation, Ethereum Improvement Proposals EIP-20, EIP-55 and EIP-2612, ethereum.org security and scam-token guides, Etherscan and Polygonscan token pages, Federal Trade Commission consumer guidance, the FBI Internet Crime Complaint Center, and Revoke.cash approval guides. All facts independently verified against cited documentation current as of October 2026.
This article is for informational and educational purposes only. It is not financial, investment, trading, or legal advice. Cryptocurrency can lose value. Borrowing on Aave can lead to liquidation if the health factor drops below 1. Spot AAVE/USDT buys the token. An AAVEUSDT Perpetual is a contract on the price. Do your own research. Consider your circumstances before using any protocol or trading any asset.