Drainer kits (drainer-as-a-service)
Ready-made drainer software rented to scammers for a cut of the loot. It powers most phishing sites you'll ever see.
How it works
Kit operators build the scripts that scan a victim's wallet, rank assets by value and ask for the right approval, permit or transaction. Affiliates bring the traffic: fake sites, hacked accounts, ads.
Stolen funds are split automatically, the operator often taking 20 to 30 percent, which is how investigators trace campaigns back to a kit.
When one kit shuts down, its affiliates move to another within days, so the names change but the methods don't.
Red flags
- Any site that asks for several signatures in a row 'to finish claiming'
- Sites that seem to know exactly which tokens you hold
- Popups that pressure you to sign quickly
Protect yourself
- Keep a strict split between a vault wallet and a hot wallet for new sites
- Rely on wallet warnings and blocklists, and never click through them
- Bookmark the sites you use and avoid links from social media
If you already signed
- Revoke approvals and delegates, then move funds to a fresh wallet
- Report the domain and the receiving addresses
Incidents using it 2
-
Noir wallet drainer kit hides its backend behind DNS TXT records and DoH
Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.
Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages·Multiple EVM chains·Since Oct 9, 2026·
-
Critical✕Still active
Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March
A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days.
Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers·Multiple EVM chains·Since Mar 1, 2026·