{
 "tag": "drainer-as-a-service",
 "name": "Drainer-as-a-service",
 "group": "Drainer kits & crews",
 "incidents": [
  {
   "slug": "noir-drainer-dns-txt-c2-oct-2026",
   "title": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026",
   "json": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Infoblox says it seems likely the Noir drainer kit is created and maintained with AI assistance, based on its verbose explanatory code comments, while noting a human could also have written it."
   },
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "noir-drainer",
    "dns-txt",
    "doh",
    "cloudflare-pages",
    "netlify",
    "walletconnect",
    "fake-airdrop",
    "infoblox",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-10-09",
   "closedAt": null,
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed."
  },
  {
   "slug": "inferno-angelferno-drainer-still-active-oct-2026",
   "title": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026",
   "json": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "drainer-kit",
   "product": "Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers",
   "tags": [
    "multi-evm",
    "drainer-kit",
    "drainer-as-a-service",
    "inferno-drainer",
    "angel-drainer",
    "angelferno",
    "purple-drainer",
    "permit2",
    "cloudflare-workers",
    "ransom-isac"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-03-01",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days."
  },
  {
   "slug": "aerodrome-velodrome-dns-hijack-nov-2025",
   "title": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025",
   "json": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "base",
    "optimism"
   ],
   "method": "front-end-hijack",
   "product": "Aerodrome (Base) and Velodrome (Optimism) web app users",
   "tags": [
    "base",
    "optimism",
    "front-end-hijack",
    "aerodrome",
    "velodrome",
    "dns-hijack",
    "eleven-drainer",
    "drainer-as-a-service",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 700000,
   "victims": null,
   "startedAt": "2025-11-21",
   "closedAt": "2025-12-02",
   "updatedAt": "2025-12-02T12:00:00Z",
   "summary": "On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise."
  }
 ],
 "changes": [
  {
   "incident": "noir-drainer-dns-txt-c2-oct-2026",
   "incidentTitle": "Noir wallet drainer kit hides its backend behind DNS TXT records and DoH",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Infoblox Threat Intel publishes its analysis of the Noir drainer kit and its DNS TXT based control channel.",
   "sourceUrl": "https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/",
   "url": "https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Ransom-ISAC publishes 'Inferno Drainer Is Burning Out', describing the ecosystem as still active.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-05-01",
   "title": "A key rotation locks the operators out of their own command contract for about 23 days (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-04-14",
   "title": "CoW Protocol domain takeover (April 2026; see cow-swap-dns-hijack-apr-2026), which the report links to the Inferno ecosystem, costs users about $1.2M over about 4.5 hours.",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "inferno-angelferno-drainer-still-active-oct-2026",
   "incidentTitle": "Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-03-01",
   "title": "AngelFerno announces it has acquired Purple Drainer (month reported; day not given).",
   "sourceUrl": "https://ransom-isac.org/blog/the-daas-formerly-known-as-inferno/",
   "url": "https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  }
 ]
}