Past drains: 2025
Drains that are contained or have gone quiet, newest first. 19 incidents.
December 2025 4
-
Medium✕Still active? Unverified
'Axiom Bookmark Method' drains trend on X, with claims of a trader losing over $200K
In late December 2025, X users warned that scammers were luring Axiom traders with fake tools such as token checkers and getting them to drag a bookmark into the browser, which ran on the logged-in Axiom page and gave the scammer access to the victim's funds. An X trending summary headlined the scam as draining over $200,000, and one widely viewed warning post said a person the author knew had recently fallen for it and asked Axiom to patch it. No security firm, news outlet or Axiom statement confirming the amount was found. Axiom users should never run a bookmark someone gives them and should move funds if they did.
Axiom trading terminal users·Solana·Since Dec 26, 2025·
-
Critical✓Contained
Trojanized Trust Wallet Chrome extension v2.68 steals seed phrases; $8.5M drained from 2,520 wallets
A malicious version 2.68 of the Trust Wallet browser extension was published to the Chrome Web Store on Dec 24, 2025 with a leaked store API key, skipping the normal release review. It harvested seed phrases through a modified analytics library and sent them to metrics-trustwallet[.]com. Early reports put losses near $7M; Trust Wallet's post-mortem says about $8.5M was drained from 2,520 wallet addresses across BTC, ETH and SOL, and traces the leak to the Shai-Hulud 2.0 npm worm. The fixed v2.69 shipped on Dec 25 and Trust Wallet says it will reimburse affected users; mobile app users were not affected.
Trust Wallet Chrome extension v2.68·Solana, Bitcoin, Ethereum·$8.5M stolen·Since Dec 24, 2025·
-
Critical✕Still active
Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history
On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end.
Ethereum USDT holder (funds withdrawn from Binance)·Ethereum·$50M stolen·Since Dec 20, 2025·
-
High✓Contained
Ethereum user loses $440K in USDC after signing a malicious permit
An Ethereum user lost $440,358 in USDC after signing a malicious ERC-20 permit signature, Scam Sniffer reported on 8 December 2025. A permit is an off-chain signature that lets another address spend your tokens, so no on-chain approval appears before the theft. Anyone who signs permit requests on unfamiliar sites is at risk; check the spender and amount before signing and revoke unknown permissions.
An Ethereum USDC holder·Ethereum·$440K stolen·Since Dec 8, 2025·
November 2025 4
-
Critical✓Contained
Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected
On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing.
Upbit exchange Solana hot wallet·Solana·$36M stolen·Since Nov 27, 2025·
-
Critical✓Contained
Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Aerodrome (Base) and Velodrome (Optimism) web app users·Base, Optimism·$700K stolen·Since Nov 21, 2025·
-
High✓Contained
DMT token airdrop promoted by @dexmaxai tied to $130K phishing loss on Solana
SlowMist's hack database lists a $130,000 phishing loss on Nov 20, 2025, filed under Solana, tied to the DMT token airdrop promoted by the X account @dexmaxai. The airdrop claim was the lure for the phishing. If you claimed DMT, check your wallet for token delegations or unexpected outgoing transfers and move what is left to a new wallet.
DMT airdrop claimants (@dexmaxai)·Solana·$130K stolen·Since Nov 20, 2025·
-
Critical✕Still active
Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash
A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.
Private whale's Gnosis Safe multisig (Ethereum)·Ethereum·$27M stolen·Since Nov 4, 2025·
October 2025 1
-
Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks
Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.
Web3 and crypto executives, founders and blockchain developers·Multiple EVM chains·Since Oct 28, 2025·
September 2025 1
-
THORChain co-founder loses about $1.35M after a fake Zoom call showing a deepfake of a friend
In early September 2025 THORChain co-founder John-Paul Thorbjornsen got a Zoom link from a friend's hacked Telegram account, joined in his browser and, by his account, saw a deepfake of his friend with no sound before leaving. An old MetaMask wallet of his was later drained of about $1.35M in Kyber Network and THORSwap tokens (PeckShield valued it at about $1.2M); he believes the key was reached through iCloud Keychain or a zero-day. ZachXBT attributed the theft to North Korean hackers, and THORChain said the protocol itself was not affected.
THORChain co-founder's personal wallet·Ethereum·$1.4M stolen·Since Sep 4, 2025·
August 2025 3
-
Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files
Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine.
Nx build system on npm·Multiple EVM chains·Since Aug 26, 2025·
-
Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key
Cointelegraph reported on 13 August 2025 that an Ethereum core developer's hot wallet was drained after he installed 'contractshark.solidity-lang', a fake Solidity extension for the Cursor AI code editor with over 54,000 downloads. The extension read his .env file and sent the private key to the attacker, who waited three days before emptying the wallet. The loss was a few hundred dollars because he kept only test funds there and his main holdings on hardware wallets. Keep keys out of .env files on development machines and use small, separate test wallets.
Cursor AI code editor users·Ethereum·Since Aug 13, 2025·
-
YouTube 'MEV bot' tutorials, some AI-generated, tricked users into deploying drainer contracts; $900K+ taken
SentinelLABS reported in August 2025 that scammers use YouTube tutorials to get people to deploy a 'free' Ethereum arbitrage bot contract through Remix, fund it with ETH and press Start. Hidden code sends the ETH to an attacker wallet, and the top attacker address alone received 244.9 ETH (about $902,000). The videos ran on aged channels with manipulated comments, and SentinelLABS says several appear to be AI-generated. Versions of the scam have run since at least early 2024 and were described as ongoing.
Ethereum users following YouTube 'MEV bot' tutorials·Ethereum·$900K stolen·Since Aug 5, 2025·
July 2025 2
-
AI-written npm package @kodane/patch-manager drained Solana wallets after 1,500+ downloads
On 28 July 2025 an npm package called @kodane/patch-manager, posing as a license-validation and registry cache tool for Node.js, was published with a hidden wallet drainer in its install script. Once installed it looked for crypto wallets on Windows, macOS and Linux and sent the funds to a Solana address, leaving just enough for fees. It was downloaded more than 1,500 times before npm flagged it on 30 July; Safety, which found it, said the code appears to be largely AI-generated. No total loss was published.
npm package @kodane/patch-manager·Solana·Since Jul 28, 2025·
-
Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer
Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.
Cursor AI code editor users (Open VSX extensions)·Multiple EVM chains·$500K stolen·Since Jul 10, 2025·
June 2025 2
-
Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections
Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.
Aave and other DeFi users receiving fake reward emails·Multiple EVM chains·Since Jun 17, 2025·
-
North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Crypto foundation staff on macOS·Multiple EVM chains·Since Jun 11, 2025·
May 2025 1
-
Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Startup founders in Polygon's investment network·Multiple EVM chains·Since May 13, 2025·
March 2025 1
-
Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet
On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send.
AIXBT AI agent wallet·Base·$106K stolen·Since Mar 18, 2025·
No drains match these filters.