DEX / MEV-bot approval phishing — email claims a DeFi aggregator (1inch, Jupiter, Paraswap, Uniswap, CoW Protocol) detected a pending MEV-bot attack on the recipient's wallet and urges emergency approval revocation at a drainer URL. Chainalysis 2026; Certik 2026 DeFi approval-scam surge.
dex-aggregator-mev-bot-approval-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Email impersonating a DEX aggregator (Uniswap, 1inch, Paraswap, KyberSwap, CoW Protocol, Jupiter) or MEV-protection service (Flashbots Protect, MEV Blocker) urging the recipient to "approve this transaction to activate MEV protection," "claim your MEV rebate," or "emergency reauthorize to prevent front-running" — with an off-protocol link that triggers a malicious setApprovalForAll or approve(max) call, granting the attacker unlimited token-spend rights. Unlike the existing erc20-permit-eip712-signature-lure (which targets off-chain EIP-712 typed-data signatures), this signal targets on-chain approval calls framed as DEX optimization. Chainalysis's 2026 Web3 Crime Report found that approval-drain attacks surpassed seed-phrase theft as the #1 DeFi attack vector in 2025, with $340M+ drained via MEV-bot phishing; CertiK's Hack3d 2025 report documented $112M across 47 approval-drain incidents on DEX integrations. The signal fires on DEX/MEV brand name + approval/activation CTA or front-running urgency language + link to a non-official protocol domain. Real DEX newsletters never instruct users to approve transactions via email.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started