Multiple EVM chains
27 incidents, 8 live. 13 days since the last new one.
22 drains in the last 12 months
22 drains in the last 12 months
21 drains in 2026
6 drains in 2025
Live
-
Noir wallet drainer kit hides its backend behind DNS TXT records and DoH
Infoblox Threat Intel described Noir on 9 October 2026, a wallet-drainer kit that looks up its backend pool through DNS TXT records over public DNS-over-HTTPS, so operators can repoint every lure page by changing one record. Lures impersonate CoinMarketCap, DexScreener, OKX, Uniswap, Lido, Hyperliquid, Morpho, Ondo, LayerZero, MegaETH, Polymarket and others with fake votes, airdrop checks and swap clones. It steals by getting token spending permissions, then cuts the WalletConnect session to hide the trail. Infoblox gave no loss figures and says the kit was likely AI-developed.
Users of Uniswap, Lido, Hyperliquid, Polymarket and other brands targeted by Noir lure pages·Multiple EVM chains·Since Oct 9, 2026·
-
Medium◐Partly contained
16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys
Socket found 16 Firefox extensions posing as Rabby Wallet (branded 'Raabby WaIIet') and OKX Wallet ('Portal WALLET'). They captured 12- or 24-word recovery phrases and private keys during the wallet import step and sent them to attacker-run Cloudflare Workers. Mozilla removed them by 5 October 2026, but Socket links them to a crypto-theft extension campaign it first saw in August 2026, so new copies may appear. No loss figure has been published; anyone who imported a seed into one of them should treat that wallet as stolen.
Firefox users who installed fake Rabby Wallet or OKX Wallet add-ons·Multiple EVM chains·Since Oct 5, 2026·
-
High✕Still active
User loses about $305K in DAI after copying a poisoned lookalike address from history
On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.
A DAI holder sending to a regular counterparty·Multiple EVM chains·$305K stolen·Since Oct 4, 2026·
-
Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets
On 18 September 2026 Japanese, US, Australian and German authorities warned that the North Korean group WaterPlum, linked to the 'Contagious Interview' campaign, infected at least 30,000 devices in more than 100 countries between December 2025 and July 2026. Posing as AI, crypto or NFT firms and recruiters, they get targets to run code during fake interviews and coding tests, including malicious npm packages and VS Code projects, then steal private keys, seed phrases and passwords. Funds or credentials were taken from over 7,000 wallets, and more than 1.7 billion yen (about $10.71M) went to North Korea. The advisory does not say the campaign has stopped.
Crypto, AI and NFT developers and job seekers·Multiple EVM chains·$11M stolen·Since Sep 18, 2026·
-
High◐Partly contained
19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons
Socket found 19 Chrome and Edge extensions, from crypto price trackers and explorers to general tools like 'Enable Right Click & Copy' (70,000+ Chrome users), that loaded a modular malware framework. It drained EVM, Solana and Tron wallets by hijacking 'Connect Wallet' and 'Swap' buttons, swapped Ledger and Trezor sites for seed-phishing pages and stole exchange sessions; five extensions were bought from their original developers and turned malicious through updates. Socket thinks the campaign may date back to early 2024. Google removed the Chrome listings, but when BleepingComputer reported it on 30 August 2026 the Edge version of one was still available.
Users of 19 Chrome/Edge extensions incl. 'Enable Right Click & Copy', 'Multi-Chain Explorer' and 'LedgerLook: Wallet Checker'·Multiple EVM chains, Solana, Tron·Since Aug 30, 2026·
-
Low✕Still active
USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts
A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.
Users of EIP-7702 smart accounts on Ethereum and other EVM chains·Multiple EVM chains·Since Aug 1, 2026·
-
Critical✕Still active
Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March
A Ransom-ISAC report published on 5 October 2026 says the Inferno drainer ecosystem, now branded AngelFerno after merging with Angel Drainer, was still running in summer 2026 with thousands of affiliates. It says AngelFerno announced it had bought Purple Drainer in March 2026, that its factory has deployed over 17,000 single-use drainer contracts, and that it targets 165 tokens on 11 EVM chains (with Solana, TRON, SUI and XRP variants). The report ties it to domain takeovers including CoW Protocol in April 2026 (about $1.2M lost) and notes a May 2026 key rotation that locked the operators out of their own command contract for about 23 days.
Web3 users targeted by Inferno/AngelFerno affiliate phishing sites and domain takeovers·Multiple EVM chains·Since Mar 1, 2026·
-
Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys
Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.
OpenClaw (ClawHub) skill users·Solana, Multiple EVM chains·Since Feb 5, 2026·
Past
September 2026 1
-
Medium✓Contained
Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers
An attacker abused an authorization flaw in email platform Brevo to reach 138 client accounts and send phishing from six of them. One was a fake Trezor 'Critical Security Alert: STM32 Entropy Vulnerability' sent to about 347,000 Trezor newsletter subscribers, linking to an app that asked for wallet backups; BitBox's list and CoinTracking (a fake 'refresh API keys' email) were also used. Trezor took the phishing domain down within 20 minutes; about 2,500 people opened the link and no losses have been reported. Recipients should expect follow-up phishing to the same addresses.
Trezor, BitBox and CoinTracking newsletter subscribers·Bitcoin, Multiple EVM chains·Since Sep 9, 2026·
July 2026 2
-
Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments
SecurityWeek reported on 6 July 2026 that Zscaler found two campaigns in use that plant hidden instructions on web pages for AI agents that can browse and pay. One used SEO poisoning to lure agents searching for a fake Python package, requests-secure-v2, backed by 10 GitHub repositories; the other typosquatted the DeFi portfolio tracker DeBank. In Zscaler's own tests 4 of 26 models were manipulated into making a payment and 2 mistook the fake DeBank site for the real one. No real losses were reported, but agents with spending power should only pay allow-listed recipients.
AI agents that browse the web and can pay·Multiple EVM chains·Since Jul 6, 2026·
-
Critical✕Still active
Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange
In early July 2026 a crypto wallet holder connected to a fake exchange site and signed a malicious contract approval that gave the attacker unlimited spending rights. An automated sweeper then emptied the wallet of about $1.65 million. Anyone who signs approvals on unfamiliar trading sites is at risk; check and revoke token approvals you do not recognise.
A crypto wallet holder using a fake exchange site·Multiple EVM chains·$1.6M stolen·Since Jul 3, 2026·
June 2026 1
-
High✓Contained
Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys
Attackers who compromised Injective Labs' GitHub repository published @injectivelabs/sdk-ts 1.20.21 to npm, along with 17 related @injectivelabs packages pinned to it. The malicious build hooked the fromMnemonic and fromHex functions and sent seed phrases and private keys to an Injective-looking endpoint whenever an app used them. It was downloaded about 310 times before being deprecated; no thefts had been reported. Any key or seed that passed through 1.20.21 should be treated as stolen; the clean version is 1.20.23.
npm package @injectivelabs/sdk-ts and 17 related @injectivelabs packages·Multiple EVM chains·Since Jun 8, 2026·
May 2026 2
-
TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools
Socket reported in late May 2026 a campaign it named TrapDoor: more than 34 malicious packages and 384+ related versions across npm, PyPI and Crates.io that steal crypto wallet data and other developer secrets. The packages also tried to alter files that AI coding tools read, such as .cursorrules and CLAUDE.md, using hidden Unicode instructions meant to get the assistant to run scan-like steps that find and send out secrets. No confirmed losses or victim counts have been published. Developers who installed flagged packages should rotate credentials and move wallet funds.
Developers installing packages from npm, PyPI and Crates.io·Multiple EVM chains·Since May 26, 2026·
-
High✕Still active
FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware
CTM360 found a shared fraud platform, FEMITBOT, behind many Telegram bots that open Mini App phishing pages inside Telegram, impersonating crypto services such as MoonPay (other outlets also list Bitget, OKX, Binance and Fragment) plus streaming and AI brands. Victims see fake balances and earnings and are told to deposit money or recruit others to 'unlock' withdrawals; some Mini Apps also push Android APK malware. No total losses have been published. Do not start bots or open Mini Apps from ads or unsolicited invites, and never pay to withdraw 'earnings'.
Telegram users targeted with fake crypto and investment bots (impersonating MoonPay and other brands)·Multiple EVM chains·Since May 3, 2026·
April 2026 2
-
High◐Partly contained
Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases
Kaspersky found 26 decoy apps on Apple's App Store (games, calculators, to-do lists) that opened a fake App Store page and pushed users to sideload trojanized versions of MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken and Bitpie. The trojanized hot wallets captured recovery phrases during wallet creation or restore, and the Ledger lure asked for the phrase directly. The campaign ran since at least fall 2025, mostly against users in China, and is attributed with moderate confidence to the SparkKitty actors; Kaspersky reported all apps to Apple. No loss total was published.
iPhone users who installed fake MetaMask, Ledger, Trust Wallet, Coinbase, TokenPocket, imToken or Bitpie apps·Multiple EVM chains, Bitcoin, Tron·Since Apr 20, 2026·
-
High✕Still active
notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies
Moonlock found notnullOSX, a macOS stealer spread through Google Ads, promoted YouTube videos and fake wallpaper sites using ClickFix-style 'paste this in Terminal' instructions. Its ReplaceApp module replaces the user's Ledger Live or Trezor app with a trojanized copy to catch the recovery phrase, and it also copies desktop and browser-extension wallet data. Operators reportedly target people holding more than $10,000 in crypto. No loss total was published.
Mac users with Ledger Live, Trezor Suite or desktop/extension wallets·Bitcoin, Multiple EVM chains·Since Apr 10, 2026·
March 2026 1
-
Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers
On 24 March 2026 attackers tracked as TeamPCP published LiteLLM 1.82.7 and 1.82.8 to PyPI with hidden code that runs on import, and in 1.82.8 whenever Python starts. LiteLLM is a popular open-source gateway that AI apps and agents use to reach many LLM providers, with over 3.4 million downloads a day. The payload collected SSH keys, cloud credentials, Kubernetes secrets, .env files and crypto wallet data and sent them to a lookalike domain. Both versions were removed; anyone who installed them should rotate secrets and move funds from wallets on affected machines.
LiteLLM on PyPI·Multiple EVM chains·Since Mar 24, 2026·
February 2026 2
-
Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down
Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published.
People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)·Multiple EVM chains·Since Feb 24, 2026·
-
North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech
Mandiant reported on 9 February 2026 an intrusion at a crypto-sector fintech that began with a message from a crypto executive's hijacked Telegram account and a Calendly invite to a spoofed Zoom meeting. On the call the victim saw what appeared to be a deepfake of another crypto company's CEO, was told their audio was broken and was talked into running 'troubleshooting' commands (ClickFix). Those commands installed seven malware families on macOS that collect credentials, browser and Telegram data to enable crypto theft. Mandiant tied it to the North Korea-linked group UNC1069 and reported no stolen amount.
Crypto and DeFi fintech staff on macOS·Multiple EVM chains·Since Feb 9, 2026·
January 2026 2
-
North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor
Check Point Research reported on 22 January 2026 that the North Korea-linked group KONNI, long focused on South Korean government targets, is now going after developers and engineering teams on blockchain and crypto projects. Phishing lures dressed up as project documentation deliver a PowerShell backdoor that Check Point calls AI-generated, with activity seen in Japan, Australia and India. A compromised developer can expose source code, infrastructure and blockchain credentials. No losses were reported.
Blockchain and crypto developers and engineering teams (Asia-Pacific)·Multiple EVM chains·Since Jan 22, 2026·
-
High✕Still active
Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps
SlowMist reported that attackers re-registered expired domains belonging to established Linux Snap Store publishers, reset the publisher accounts, and pushed updates that turned trusted apps into fake Exodus, Ledger Live and Trust Wallet clients. The fake apps ask for the wallet recovery phrase and send it to the attackers. Linux users who installed wallet apps from the Snap Store should check the publisher and never type a recovery phrase into a desktop app. No loss total was published.
Linux users installing wallet apps from the Snap Store·Bitcoin, Multiple EVM chains·Since Jan 21, 2026·
October 2025 1
-
Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks
Kaspersky disclosed on 28 October 2025 two BlueNoroff campaigns aimed at Web3 and crypto organisations in India, Turkey, Australia and other countries in Europe and Asia, active since at least April 2025. GhostCall reaches executives and founders on Telegram with fake investor meetings, where an 'audio fix' installs malware; GhostHire sends blockchain developers fake job tests in GitHub repositories that hide malware. Kaspersky says generative AI has helped the group develop malware faster, and the payloads include crypto stealers. No loss figures were given.
Web3 and crypto executives, founders and blockchain developers·Multiple EVM chains·Since Oct 28, 2025·
August 2025 1
-
Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files
Around 26 August 2025 malicious versions of Nx, a widely used JavaScript build tool, were published to npm and stole GitHub and npm tokens on install. The malware also looked for installed AI command-line tools (Claude, Gemini and Amazon Q) and ran them to search the disk for crypto wallet and keystore files, .env files and SSH keys, then published the results to repos in the victim's own GitHub account. Wiz counted over 1,700 users with leaked secrets and over 6,700 private repos made public, but saw no successful crypto theft, partly because the AI tools often refused. Anyone who installed the bad versions should rotate tokens and move funds from wallet files on that machine.
Nx build system on npm·Multiple EVM chains·Since Aug 26, 2025·
July 2025 1
-
Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer
Kaspersky reported on 10 July 2025 that a blockchain developer lost about $500,000 in crypto after installing a fake Solidity extension in Cursor, an AI code editor built on VS Code that gets extensions from the Open VSX registry. The extension gave no Solidity support; it installed ScreenConnect remote-access software, then the Quasar backdoor and a stealer that took browser, email and wallet data, including seed phrases. The attackers used the seed phrases to drain the developer's wallets. Developers should vet editor extensions and never keep seed phrases or funded keys on a coding machine.
Cursor AI code editor users (Open VSX extensions)·Multiple EVM chains·$500K stolen·Since Jul 10, 2025·
June 2025 2
-
Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections
Proofpoint reported on 20 August 2025 that criminals were using Lovable, an AI website builder that makes sites from text prompts, to create and host phishing and wallet-drainer pages. In June 2025 nearly 10,000 emails sent through SendGrid led to a Lovable-built app that redirected to a fake Aave site asking people to connect a crypto wallet; Proofpoint said the likely aim was to steal assets from any connected wallet. Lovable removed a phishing cluster and added real-time checks after the report. No loss figures were published.
Aave and other DeFi users receiving fake reward emails·Multiple EVM chains·Since Jun 17, 2025·
-
North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac
Huntress reported on 18 June 2025 that an employee of a cryptocurrency foundation was contacted on Telegram, sent a Calendly invite and led to a fake Zoom domain. Weeks later the employee joined a group call that contained several deepfakes of the company's senior leadership; when 'audio problems' came up, they were told to install a Zoom extension that was really a malicious AppleScript. It installed a set of macOS backdoors, a keylogger and screen recorder, and a crypto-wallet stealer called CryptoBot. Huntress did not say whether funds were stolen.
Crypto foundation staff on macOS·Multiple EVM chains·Since Jun 11, 2025·
May 2025 1
-
Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Startup founders in Polygon's investment network·Multiple EVM chains·Since May 13, 2025·
No drains match these filters.