{"investigation":{"slug":"lucifer-daas","entity_name":"Lucifer DaaS","trust_score":0,"severity_base":null,"score_modifier":-19,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Lucifer DaaS (also referred to as Lucifer Drainer) is a criminal drainer-as-a-service platform active from at least January 2025, analyzed by Flare threat intelligence researchers across approximately 700 posts from underground forums and Telegram channels. It runs an affiliate commission model in which operators keep 20% of each successful drain and affiliates supplying phishing traffic keep 80%, and it has progressively professionalized its tooling with multichain wallet draining, Permit2 signature abuse, automated phishing-site deployment and site cloning. Despite Telegram bot bans in August 2025 and a documentation-domain suspension in November 2025, it migrated to IPFS and remained active and recruiting as of May 2026; no operator identities, attributable wallet addresses or law enforcement actions have been publicly reported.","sections":[{"content":"Lucifer DaaS, also referred to as Lucifer Drainer, is a fully criminal enterprise offering drainer-as-a-service (DaaS) tooling; it is not a financial product, exchange or legitimate protocol of any kind. It automates cryptocurrency wallet theft via phishing pages, malicious smart contract signatures and abuse of token-approval mechanisms. Unlike earlier drainer operations that sold software kits outright, Lucifer states the software is 'not for sale' and recruits affiliates who supply phishing traffic, a structure that more closely resembles the ransomware-as-a-service affiliate model than traditional phishing kit sales. Flare researchers analyzed approximately 700 posts collected from underground forums, chats, channels and Telegram communities associated with Lucifer DaaS between January 2025 and early 2026, and characterized it as an increasingly professionalized criminal ecosystem with traits of a software-as-a-service business: product versioning, release notes, bug-fix cycles, customer support, referral systems and affiliate onboarding. The platform runs on infrastructure and affiliate networks separate from other named drainer operations such as Inferno, Vanilla, Angel, Quark, Pink and MS Drainer, while recruiting from communities where predecessor brands including Inferno, Angel, Venom, Nova, Ghost, Medusa, Vega and Monkey Drainer were previously active; one input page describes it as occupying a dominant position in the current drainer ecosystem.","heading":"Overview and Classification","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/","name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","credibility":2}],"severity":"critical"},{"content":"Lucifer operates on commission sharing only: the operators state the software cannot be bought or leased, and in May 2025 channel posts confirmed it only splits '20% per hit' — operators keep 20% of each successful drain and affiliates receive 80%. This split is standard across the DaaS industry: BlockSec's joint research with Zhejiang University and MBZUAI, covering $135 million in on-chain drainer activity from March 2023 to April 2025, found a 20/80 operator-affiliate split was the dominant model across 1,910 profit-sharing contracts and 87,077 profit-sharing transactions involving 56 operator accounts and 6,087 affiliate accounts. Lucifer recruits through underground forums and Telegram channels, presenting itself as a 'professional solution'. Its recruitment messages discouraged complete beginners in favour of 'experienced affiliates capable of generating reliable phishing traffic', even though the platform's own automation lowers the technical threshold; 'traffic' — the ability to funnel victims to phishing sites — was a recurring qualification in operator communications. Affiliates generate traffic through fake crypto project websites, NFT minting pages, airdrop claim portals and DeFi interfaces, while the Lucifer back-end handles transaction signatures, approvals and token transfers once a victim connects a wallet. Operators also discussed customer support, hosting recommendations and referral systems, indicating a structured internal organization rather than a loosely coordinated operation.","heading":"Business Model and Affiliate Recruitment","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://decodecybercrime.com/crypto-drainers-of-2025-the-rising-web-of-wallet-theft/","name":"Crypto Drainers of 2025: The Rising Web of Wallet Theft — DeCode Cybercrime","type":"research","credibility":3},{"url":"https://blocksec.com/blog/inside-ethereum-s-shadow-economy-new-research-unmasks-the-135-m-drainer-as-a-service-industry","name":"Inside Ethereum's Shadow Economy: New Research Unmasks the $135M Drainer-as-a-Service Industry — BlockSec","type":"research","credibility":2}],"severity":"critical"},{"content":"In March 2025 the operators announced version 6.6.6 of the drainer, advertising ERC-20 token support, Permit2 abuse, off-chain signature exploitation, Telegram notifications for affiliates, wallet-security bypasses and multichain functionality across EVM-compatible networks. Later announcements covered bug fixes, wallet compatibility updates, Telegram-browser support, deployment improvements and hosting features. A 'Zero Config' automated deployment workflow lets affiliates with minimal technical skill upload static files and receive a phishing-ready ZIP package preloaded with the latest Lucifer code for the target site. A website-cloning feature lets affiliates replicate legitimate crypto projects, including DeFi, NFT and airdrop sites, as phishing frontends. Permit2 abuse is particularly dangerous: Uniswap's Permit2 standard authorizes token transfers through off-chain signed permissions (EIP-712 typed messages) without gas fees, so the malicious approval can be presented as a routine 'Login' or 'Verify Identity' message-signing step rather than an obvious on-chain approval. Off-chain signatures via EIP-2612 let the attacker later submit the signed authorization on-chain without further user approval, after which the drainer can sweep ERC-20 and other supported balances almost instantly. No smart contract addresses or on-chain indicators for Lucifer's commission-collection infrastructure had been publicly documented as of mid-2026.","heading":"Technical Capabilities and Version History","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://bithide.io/blog/secure-crypto-from-drainers/","name":"Drainer-as-a-Service (DaaS): How This Software Steals Your Crypto — Bithide","type":"research","credibility":3},{"url":"https://www.dextools.io/tutorials/permit2-phishing-risks-2026","name":"Permit2 Phishing Risks: Why Signature Scams Are So Dangerous — DEXTools","type":"research","credibility":2}],"severity":"critical"},{"content":"Lucifer has repeatedly adapted to platform-level enforcement. In August 2025 Telegram banned the operation's automated bots; the operators instructed affiliates in their channel to create replacement bots and grant them administrative privileges, resuming operations without meaningful disruption. In November 2025 a documentation domain hosted on Google Firebase was suspended, reportedly after exposure in security research. The operators moved all documentation to the InterPlanetary File System (IPFS), a decentralized peer-to-peer file distribution protocol, explicitly framing the move as a resilience strategy against centralized takedowns and removing a central point of failure. Continuity after both actions suggests the group maintains redundant communication and distribution channels. As of BleepingComputer's May 2026 report, the operation remained live and was actively recruiting affiliates.","heading":"Operational Resilience and Infrastructure","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Lucifer targets holders of ERC-20 tokens and other multichain assets across EVM-compatible networks; because of its multichain capability, users on Ethereum mainnet and compatible L2 or sidechain networks are equally exposed. Victims are lured to counterfeit websites impersonating legitimate crypto projects, NFT collections, DeFi protocols, airdrop distributions or wallet-connection flows, reached through phishing links, fake websites, compromised social media accounts, malicious advertisements, spam and direct messages. The 'Zero Config' and site-cloning features mean high-fidelity replicas of real projects can be deployed quickly by affiliates with limited technical skill. Once a victim connects a wallet and approves a malicious transaction or signs a Permit2 message — often presented as routine authentication and costing no gas — the back-end executes token sweeps within seconds, in a single subsequent on-chain transaction with no further user interaction. Users interacting with newly launched tokens, NFT mints, airdrop claims or unfamiliar DeFi platforms are at highest risk. Warning signs include unsolicited wallet-connection prompts, requests to sign Permit or Permit2 messages (especially 'gasless claim' or 'off-chain signature' prompts), signature requests that do not originate from a trusted application URL, and social-media campaigns promoting limited-time token distributions.","heading":"Victim Profile, Attack Vectors and Warning Signs","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://en.cryptonomist.ch/2026/07/09/uniswap-permit2-phishing-risk/","name":"Uniswap Permit2 Phishing: $1 Million Loss Highlights Risk — Cryptonomist","type":"news_article","credibility":2},{"url":"https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/","name":"Crypto Wallet Drainers — Group-IB Knowledge Hub","type":"research","credibility":2},{"url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/","name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","credibility":2}],"severity":"high"},{"content":"No real-world identities of the Lucifer operators had been publicly attributed as of mid-2026. No arrests, indictments, DOJ charges, or regulatory actions by the SEC, CFTC, FBI or international equivalents have been publicly announced in connection with this operation. The operators communicate only through pseudonymous Telegram channels and underground forums with no known public-facing individuals. The IPFS migration, rapid Telegram bot replacement, commission-only distribution (rather than kit sales) and affiliate vetting all reduce the forensic surface available to investigators. Other DaaS operations have faced pressure: Inferno Drainer's operators shut down in 2023 citing 'too much attention', and actors in adjacent drainer networks have faced FBI or international law enforcement pressure, but no comparable public action has been announced for Lucifer. The anonymous nature of the team is itself a significant risk signal for anyone interacting with infrastructure it operates.","heading":"Attribution and Law Enforcement Status","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/","name":"Return of the Crypto Inferno Drainer — Check Point Research","type":"research","credibility":1}],"severity":"high"},{"content":"Lucifer operates in a crowded and competitive DaaS market shaped by the exits of several predecessors. Named drainers in the ecosystem include Inferno, Angel (GhostSec), Vanilla, Pink, MS Drainer and CLINKSINK. Inferno Drainer, which claimed responsibility for over $80 million in thefts, announced a shutdown in November 2023 but was later confirmed by Check Point Research to have resurfaced and stolen at least $9 million from more than 30,000 wallets over a subsequent six-month period; in October 2024 Inferno announced it was handing its platform to Angel Drainer. Angel Drainer shut down in July 2024 after Match Systems researchers claimed to have de-anonymized its developers, but resurfaced as AngelX within weeks, deploying over 300 malicious dApps in four days. Pink Drainer ceased operations in May 2024 after stealing approximately $85 million from over 21,000 victims. Each shutdown left experienced phishing affiliates looking for new platforms, a dynamic Lucifer has exploited through targeted recruitment in communities where those brands operated. The input pages differ on whether these brands remain active competitors: one lists Inferno, Angel, Pink and others as drainers Lucifer operates alongside, while the other states that Angel, Inferno and Pink have all since reduced operations or exited and describes Lucifer as the successor absorbing their affiliates.","heading":"Ecosystem Context and Predecessor Drainers","sources":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","credibility":1},{"url":"https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/","name":"Return of the Crypto Inferno Drainer — Check Point Research","type":"research","credibility":1},{"url":"https://beincrypto.com/pink-drainer-shuts-down/","name":"Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto","type":"news_article","credibility":2},{"url":"https://defi-planet.com/2024/07/crypto-malware-angel-drainer-reportedly-shuts-down-following-identification-of-developers/","name":"Angel Drainer Reportedly Shuts Down Following Identification of Developers — DeFi Planet","type":"news_article","credibility":2}],"severity":"high"},{"content":"Scam Sniffer reported that wallet drainers stole $494 million in 2024 across 332,000 wallet addresses, a 67% increase over the $295 million stolen in 2023. For 2025 Scam Sniffer reported an 83% decline in tracked phishing losses to approximately $84 million ($83.85 million), attributed partly to improved wallet-security tooling, though the drainer ecosystem 'remains active' with new entrants, persistent affiliate networks and adapted techniques, including EIP-7702 account-abstraction exploits after Ethereum's Pectra upgrade. CertiK's broader phishing category recorded $723 million across 248 incidents using a wider scope. BlockSec's joint study covering March 2023 to April 2025 attributed $135 million in on-chain losses to the Ethereum DaaS ecosystem, with 76,582 victims; the three dominant platforms in that period were Angel Drainer ($53.1 million), Inferno Drainer ($59 million) and Pink Drainer ($14.7 million). The study found only 10.8% of DaaS-related addresses had previously been flagged by public trackers such as Etherscan. A 2025 paper, 'Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum' (Proceedings of the 2025 ACM Internet Measurement Conference), examined on-chain and off-chain mechanics of Ethereum DaaS at scale. Neither the BlockSec nor the ACM work names or quantifies Lucifer specifically; the Flare analysis reported by BleepingComputer in May 2026 remains the most specific published research on the Lucifer brand. The $1.93 billion figure sometimes cited alongside DaaS operations comes from Kroll's H1 2025 estimate of all crypto theft (hacks, exploits, phishing and social engineering combined) and should not be attributed to Lucifer or to DaaS alone; Phishdestroy's 'Anatomy of a Crypto Drainer: How $1.93B Vanished in 6 Months' uses it as context without quantifying Lucifer's share. No primary source attributes a specific loss total to Lucifer.","heading":"DaaS Industry Losses and Research","sources":[{"url":"https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","name":"Scam Sniffer 2024: Web3 Phishing Attacks — Wallet Drainers Drain $494 Million","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","name":"Cryptocurrency Wallet Drainers Stole $494 Million in 2024 — BleepingComputer","type":"news_article","credibility":1},{"url":"https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/","name":"Scam Sniffer 2025: Crypto Phishing Losses Fall 83% to $84 Million — Scam Sniffer","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/crypto-phishing-losses-fell-83-percent-2025-wallet-drainers","name":"Crypto Phishing Losses Fell 83% in 2025, Scam Sniffer Reports — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://blocksec.com/blog/inside-ethereum-s-shadow-economy-new-research-unmasks-the-135-m-drainer-as-a-service-industry","name":"Inside Ethereum's Shadow Economy: New Research Unmasks the $135M Drainer-as-a-Service Industry — BlockSec","type":"research","credibility":2},{"url":"https://dl.acm.org/doi/10.1145/3730567.3764476","name":"Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum — ACM IMC 2025","type":"research","credibility":1},{"url":"https://phishdestroy.io/crypto-drainer-anatomy","name":"Anatomy of a Crypto Drainer: How $1.93B Vanished in 6 Months — Phishdestroy","type":"research","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-11","event":"Inferno Drainer announces shutdown after claiming over $80 million in total theft; it was later found to have continued operating covertly.","source":"Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNews","source_url":"https://cryptonews.net/news/security/27907982/"},{"date":"2024-05","event":"Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.","source":"Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto","source_url":"https://beincrypto.com/pink-drainer-shuts-down/"},{"date":"2024-07","event":"Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.","source":"Angel Drainer App Shuts Down After Developer Identification — CryptoTimes","source_url":"https://www.cryptotimes.io/2024/07/17/angel-drainer-app-shuts-down-after-developer-identification/"},{"date":"2024-10","event":"Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team.","source":"Angel Drainer Absorbs Inferno's Toolkit — CryptoRank","source_url":"https://cryptorank.io/news/feed/f118d-inferno-drainer-hands-over-to-angel-drainer"},{"date":"2025","event":"Start of the period covered by Flare's analysis: approximately 700 Lucifer DaaS posts from underground forums, chats and Telegram channels collected between January 2025 and early 2026.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"},{"date":"2025-03","event":"Lucifer operators announce version 6.6.6, introducing ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses and multichain functionality; the announcement reiterates the software is not for sale and the 20% operator commission.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"},{"date":"2025-05","event":"Lucifer channel posts restate the commission-only model: the operation does not sell or lease the software and only splits '20% per hit'; affiliate recruitment continues.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"},{"date":"2025-08","event":"Telegram bans Lucifer DaaS bots. Operators instruct affiliates to create new bots and grant them administrative privileges, restoring operations without extended downtime.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"},{"date":"2025-11","event":"Lucifer's documentation domain hosted on Google Firebase is suspended, reportedly following security research disclosures; operators migrate documentation to IPFS, citing decentralization as takedown resistance.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"},{"date":"2026-05","event":"BleepingComputer publishes Flare's analysis of Lucifer DaaS, the first detailed public research into its internal structure, business model and technical evolution, reporting the platform still live and recruiting affiliates.","source":"Inside a Crypto Drainer — BleepingComputer (Flare research)","source_url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/"}],"sources_used":[{"url":"https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","name":"Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet — BleepingComputer (Flare research, published May 21, 2026)","type":"news_article","archive_url":"http://web.archive.org/web/20260731181903/https://www.bleepingcomputer.com/news/security/inside-a-crypto-drainer-how-to-spot-it-before-it-empties-your-wallet/","credibility":1,"archive_timestamp":"2026-07-31T18:19:03+00:00"},{"url":"https://dl.acm.org/doi/10.1145/3730567.3764476","name":"Unmasking the Shadow Economy: A Deep Dive into Drainer-as-a-Service Phishing on Ethereum — ACM IMC 2025","type":"research","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://blocksec.com/blog/inside-ethereum-s-shadow-economy-new-research-unmasks-the-135-m-drainer-as-a-service-industry","name":"Inside Ethereum's Shadow Economy: New Research Unmasks the $135M Drainer-as-a-Service Industry — BlockSec","type":"research","archive_url":"http://web.archive.org/web/20260209114224/https://blocksec.com/blog/inside-ethereum-s-shadow-economy-new-research-unmasks-the-135-m-drainer-as-a-service-industry","credibility":2,"archive_timestamp":"2026-02-09T11:42:24+00:00"},{"url":"https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","name":"Scam Sniffer 2024: Web3 Phishing Attacks — Wallet Drainers Drain $494 Million","type":"research","archive_url":"http://web.archive.org/web/20260526031858/https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","credibility":2,"archive_timestamp":"2026-05-26T03:18:58+00:00"},{"url":"https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/","name":"Scam Sniffer 2025: Crypto Phishing Losses Fall 83% to $84 Million","type":"research","archive_url":"http://web.archive.org/web/20260525195036/https://drops.scamsniffer.io/scam-sniffer-2025-crypto-phishing-losses-fall-83-to-84-million/","credibility":2,"archive_timestamp":"2026-05-25T19:50:36+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","name":"Cryptocurrency Wallet Drainers Stole $494 Million in 2024 — BleepingComputer","type":"news_article","archive_url":"http://web.archive.org/web/20260308104644/https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","credibility":1,"archive_timestamp":"2026-03-08T10:46:44+00:00"},{"url":"https://phishdestroy.io/crypto-drainer-anatomy","name":"Anatomy of a Crypto Drainer: How $1.93B Vanished in 6 Months — Phishdestroy","type":"research","archive_url":"http://web.archive.org/web/20260804134743/https://phishdestroy.io/crypto-drainer-anatomy","credibility":3,"archive_timestamp":"2026-08-04T13:47:43+00:00"},{"url":"https://cointelegraph.com/news/crypto-phishing-losses-fell-83-percent-2025-wallet-drainers","name":"Crypto Phishing Losses Fell 83% in 2025, Scam Sniffer Reports — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260411122253/https://cointelegraph.com/news/crypto-phishing-losses-fell-83-percent-2025-wallet-drainers","credibility":2,"archive_timestamp":"2026-04-11T12:22:53+00:00"},{"url":"https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/","name":"Return of the Crypto Inferno Drainer — Check Point Research 2025","type":"research","archive_url":"http://web.archive.org/web/20260115180606/https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/","credibility":1,"archive_timestamp":"2026-01-15T18:06:06+00:00"},{"url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/","name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","archive_url":"http://web.archive.org/web/20260511143305/https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/","credibility":2,"archive_timestamp":"2026-05-11T14:33:05+00:00"},{"url":"https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/","name":"Crypto Wallet Drainers — Group-IB Knowledge Hub","type":"research","archive_url":"http://web.archive.org/web/20260707115909/https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/","credibility":2,"archive_timestamp":"2026-07-07T11:59:09+00:00"},{"url":"https://en.cryptonomist.ch/2026/07/09/uniswap-permit2-phishing-risk/","name":"Uniswap Permit2 Phishing: $1 Million Loss Highlights Risk — Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260805123752/https://en.cryptonomist.ch/2026/07/09/uniswap-permit2-phishing-risk/","credibility":2,"archive_timestamp":"2026-08-05T12:37:52+00:00"},{"url":"https://sqmagazine.co.uk/phishing-and-wallet-drainer-incidents-statistics/","name":"Phishing and Wallet Drainer Incidents Statistics 2025 — SQ Magazine","type":"research","archive_url":"http://web.archive.org/web/20260309184313/https://sqmagazine.co.uk/phishing-and-wallet-drainer-incidents-statistics/","credibility":3,"archive_timestamp":"2026-03-09T18:43:13+00:00"},{"url":"https://cyberscope.medium.com/drainer-as-a-service-daas-unmasking-the-dark-webs-latest-threat-e54ad69d12da","name":"Drainer-as-a-Service (DaaS): Unmasking the Dark Web's Latest Threat — Cyberscope / Medium","type":"research","archive_url":"http://web.archive.org/web/20251118162804/https://cyberscope.medium.com/drainer-as-a-service-daas-unmasking-the-dark-webs-latest-threat-e54ad69d12da","credibility":3,"archive_timestamp":"2025-11-18T16:28:04+00:00"},{"url":"https://bithide.io/blog/secure-crypto-from-drainers/","name":"Drainer-as-a-Service (DaaS): How This Software Steals Your Crypto — Bithide","type":"research","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://decodecybercrime.com/crypto-drainers-of-2025-the-rising-web-of-wallet-theft/","name":"Crypto Drainers of 2025: The Rising Web of Wallet Theft — DeCode Cybercrime","type":"research","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://beincrypto.com/pink-drainer-shuts-down/","name":"Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20240928193829/https://beincrypto.com/pink-drainer-shuts-down/","credibility":2,"archive_timestamp":"2024-09-28T19:38:29+00:00"},{"url":"https://cryptorank.io/news/feed/f118d-inferno-drainer-hands-over-to-angel-drainer","name":"Angel Drainer Absorbs Inferno's Toolkit — CryptoRank","type":"news_article","archive_url":"https://web.archive.org/web/20260727043311/https://cryptorank.io/news/feed/f118d-inferno-drainer-hands-over-to-angel-drainer","credibility":2,"archive_timestamp":"2026-07-27T04:33:11+00:00"},{"url":"https://www.cryptotimes.io/2024/07/17/angel-drainer-app-shuts-down-after-developer-identification/","name":"Angel Drainer App Shuts Down After Developer Identification — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260726194729/https://www.cryptotimes.io/2024/07/17/angel-drainer-app-shuts-down-after-developer-identification/","credibility":2,"archive_timestamp":"2026-07-26T19:47:29+00:00"},{"url":"https://defi-planet.com/2024/07/crypto-malware-angel-drainer-reportedly-shuts-down-following-identification-of-developers/","name":"Angel Drainer Reportedly Shuts Down Following Identification of Developers — DeFi Planet","type":"news_article","archive_url":"http://web.archive.org/web/20261010205523/https://defi-planet.com/2024/07/crypto-malware-angel-drainer-reportedly-shuts-down-following-identification-of-developers/","credibility":2,"archive_timestamp":"2026-10-10T20:55:23+00:00"},{"url":"https://www.securityalliance.org/news/2025-10-drainers-vol-1","name":"The State of Drainers Vol. 1 — Security Alliance (SEAL)","type":"research","archive_url":"http://web.archive.org/web/20251017073949/https://www.securityalliance.org/news/2025-10-drainers-vol-1","credibility":2,"archive_timestamp":"2025-10-17T07:39:49+00:00"},{"url":"https://www.dextools.io/tutorials/permit2-phishing-risks-2026","name":"Permit2 Phishing Risks: Why Signature Scams Are So Dangerous — DEXTools","type":"research","archive_url":"https://web.archive.org/web/20260726230406/https://www.dextools.io/tutorials/permit2-phishing-risks-2026","credibility":2,"archive_timestamp":"2026-07-26T23:04:06+00:00"},{"url":"https://cryptonews.net/news/security/27907982/","name":"Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNews","type":"news_article","archive_url":"http://web.archive.org/web/20260725085100/https://cryptonews.net/news/security/27907982/","credibility":2,"archive_timestamp":"2026-07-25T08:51:00+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-08-04T23:36:21.99592+00:00","updated_at":"2026-10-31T14:52:52.07319+00:00"},"source_quality":{"total":23,"tier1":0,"tier2":1,"tier3":0,"unrated":22},"follower_count":null,"content_updated_at":"2026-10-27T06:48:25.303Z","last_fact_checked_at":"2026-10-27T06:48:25.094Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}