Doh
1 incident, 1 live. 13 days since the last new one.
1 drains in the last 12 months
1 drains in the last 12 months
1 drains in 2026
Live
-
Noir wallet drainer kit hides its backend behind DNS TXT records and DoH
Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.
Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages·Multiple EVM chains·Since Oct 9, 2026·
No drains match these filters.