# Multiple EVM chains · Drain Watch

27 incidents, 8 live. JSON: https://drains.watch/t/multi-evm.json · RSS: https://drains.watch/t/multi-evm/feed.xml

- [Noir wallet drainer kit hides its backend behind DNS TXT records and DoH](https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026) (live, High, Still active, since Oct 9, 2026)
- [16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys](https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026) (live, Medium, Partly contained, since Oct 5, 2026)
- [User loses about $305K in DAI after copying a poisoned lookalike address from history](https://drains.watch/i/address-poisoning-305k-dai-oct-2026) (live, High, Still active, since Oct 4, 2026)
- [Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets](https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026) (live, Critical, Still active, since Sep 18, 2026)
- [Brevo login flaw lets attacker email a fake Trezor 'STM32 entropy' alert to 347,000 subscribers](https://drains.watch/i/brevo-flaw-trezor-bitbox-phishing-emails-sep-2026) (closed, Medium, Contained, since Sep 9, 2026)
- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026) (live, High, Partly contained, since Aug 30, 2026)
- [USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts](https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026) (live, Low, Still active, since Aug 1, 2026)
- [Zscaler: live web campaigns hide prompt injections telling browsing AI agents to make crypto payments](https://drains.watch/i/zscaler-web-prompt-injection-ai-agent-crypto-payments-jul-2026) (closed, Low, Still active, since Jul 6, 2026)
- [Wallet holder loses $1.65M after signing an unlimited token approval on a fake exchange](https://drains.watch/i/fake-exchange-unlimited-approval-1-65m-jul-2026) (closed, Critical, Still active, since Jul 3, 2026)
- [Compromised Injective SDK on npm hooks key functions to steal seed phrases and private keys](https://drains.watch/i/injective-sdk-ts-npm-key-stealer-jun-2026) (closed, High, Contained, since Jun 8, 2026)
- [TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools](https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026) (closed, High, Partly contained, since May 26, 2026)
- [FEMITBOT: fake Telegram bots and Mini Apps impersonate crypto brands to take deposits and push Android malware](https://drains.watch/i/femitbot-telegram-mini-app-fraud-may-2026) (closed, High, Still active, since May 3, 2026)
- [Kaspersky finds 26 'FakeWallet' apps on Apple's App Store stealing wallet recovery phrases](https://drains.watch/i/kaspersky-fakewallet-26-ios-apps-apr-2026) (closed, High, Partly contained, since Apr 20, 2026)
- [notnullOSX Mac stealer swaps Ledger Live and Trezor apps for trojanized copies](https://drains.watch/i/notnullosx-mac-stealer-trojanized-ledger-trezor-apr-2026) (closed, High, Still active, since Apr 10, 2026)
- [Compromised LiteLLM releases on PyPI steal cloud keys and crypto wallet data from AI developers](https://drains.watch/i/litellm-pypi-teampcp-credential-wallet-stealer-mar-2026) (closed, Critical, Contained, since Mar 24, 2026)
- [Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March](https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026) (live, Critical, Still active, since Mar 1, 2026)
- [Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down](https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026) (closed, Low, Contained, since Feb 24, 2026)
- [North Korea's UNC1069 used an apparent deepfake CEO on a fake Zoom call to infect a crypto fintech](https://drains.watch/i/unc1069-deepfake-ceo-zoom-clickfix-crypto-fintech-feb-2026) (closed, Medium, Still active, since Feb 9, 2026)
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026) (live, High, Partly contained, since Feb 5, 2026)
- [North Korea-linked KONNI targets blockchain developers with an AI-generated PowerShell backdoor](https://drains.watch/i/konni-ai-generated-backdoor-blockchain-developers-jan-2026) (closed, Medium, Still active, since Jan 22, 2026)
- [Hijacked Snap Store publisher accounts push fake Exodus, Ledger Live and Trust Wallet apps](https://drains.watch/i/snap-store-fake-wallet-updates-expired-domains-jan-2026) (closed, High, Still active, since Jan 21, 2026)
- [Kaspersky: North Korea's BlueNoroff uses generative AI to speed up malware in GhostCall and GhostHire crypto attacks](https://drains.watch/i/bluenoroff-ghostcall-ghosthire-genai-malware-oct-2025) (closed, Medium, Still active, since Oct 28, 2025)
- [Compromised Nx npm packages ran victims' AI command-line tools to hunt for wallet and keystore files](https://drains.watch/i/nx-s1ngularity-npm-malware-ai-cli-wallet-search-aug-2025) (closed, Critical, Contained, since Aug 26, 2025)
- [Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer](https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025) (closed, High, Partly contained, since Jul 10, 2025)
- [Phishing campaign used the AI site builder Lovable to fake Aave and push wallet connections](https://drains.watch/i/lovable-ai-built-aave-phishing-sites-jun-2025) (closed, Medium, Partly contained, since Jun 17, 2025)
- [North Korea's BlueNoroff used deepfaked executives on a Zoom call to infect a crypto foundation employee's Mac](https://drains.watch/i/bluenoroff-deepfake-zoom-crypto-foundation-jun-2025) (closed, Medium, Still active, since Jun 11, 2025)
- [Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account](https://drains.watch/i/polygon-cofounder-deepfake-zoom-calls-may-2025) (closed, Medium, Still active, since May 13, 2025)