Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #1[disputed][awaiting moderator]in the timeline

   “Largest cluster of Eleven Drainer drain activity observed, with the majority of the confirmed $4.2 million in November losses occurring between November 6 and November 8, 2025.”

   reviewerLargest cluster of drain activity occurred Nov 6-8, 2025, accounting for the majority of the confirmed $4.2MSource describes one admin wallet's largest inflow window, not a majority of total losses. The $4.2M is a community estimate, not confirmed.
   Proposed correction (not yet applied)

   Largest drain activity into one Eleven Drainer admin wallet observed between November 6 and November 8, 2025.
   citedwww.bitbbq.com/en/304625/
2. #2[disputed][awaiting moderator]in the summary

   “The kit is associated with confirmed theft of at least $4.2 million across a three-week window in November 2025”

   reviewerKit associated with confirmed theft of at least $4.2M across a three-week window in November 2025Summary calls the figure 'confirmed' while section 'Financial Losses and Scale' says it is an unverified community estimate. Internal inconsistency; the source is a tier-3 outlet.
   Proposed correction (not yet applied)

   The kit is associated with an estimated theft of at least $4.2 million across a three-week window in November 2025
   citedwww.bitbbq.com/en/304625/

No source the reviewer could reach confirms or contradicts the claim.

1. #8[unverifiable][awaiting moderator]in section: Aerodrome and Velodrome DNS Hijack (November 2025)

   “Attackers compromised an account at domain registrar NameSilo, modified SOA, NS, and A records for aerodrome.finance and velodrome.finance, stripped DNSSEC protections, and redirected both domains to a cloned frontend serving Eleven Drainer JavaScript.”

   reviewerNameSilo registrar account compromised; DNSSEC strippedBlockaid does not name NameSilo; CoinDesk and others were not fetched in this review, so the registrar detail is unchecked.
   citedwww.coindesk.com/web3/2025/11/22/aerodro…void-main-domain
2. #11[unverifiable][awaiting moderator]in section: Financial Losses and Scale

   “Across the DaaS sector, drainers were responsible for an estimated $494 million in losses industry-wide during 2024, a 67 percent increase from the prior year”

   reviewerDrainers caused $494M in losses in 2024, a 67% increaseNot fetched in this review; the cited headline says about $500M, which is consistent but unchecked.
   citedwww.infosecurity-magazine.com/news/scamm…-crypto-wallets/

The cited evidence supports part of the claim but not all of it.

1. #5[partially supported][awaiting moderator]in section: Overview and Classification

   “Eleven Drainer was first publicly identified by SlowMist founder Yu Xian on November 9, 2025, when his team noted a growing cluster of victims linked to the operation.”

   reviewerYu Xian first publicly identified Eleven Drainer on Nov 9, 2025Nov 9 warning corroborated secondhand, but BITBBQ puts large drain activity on Nov 6-8, so 'first publicly identified' is not established. BeInCrypto was blocked.
   citedbeincrypto.com/crypto-phishing-gang-eleven-drainer/
2. #7[partially supported][awaiting moderator]in section: Aerodrome and Velodrome DNS Hijack (November 2025)

   “Approximately $700,000 was stolen from users outside Blockaid's protection network across nine attacker-controlled addresses during the four-hour window the attack was active.”

   reviewerApprox $700K stolen during a four-hour window the attack was activeDollar amount and addresses match; 'four-hour' is not in the Blockaid source and its timeline implies about 2.5 hours. Other cited sources not checked for this.
   citedwww.blockaid.io/blog/how-blockaids-custo…drome-dns-attack

The cited evidence supports the claim as written.

1. #3[confirmed][no action needed]in section: Known On-Chain Identifiers

   “The ENS name elevendrainer.eth resolves to wallet address 0x498Dc5153F5BB71801049281ECB6F378B284B166, which appears to have been used primarily for testing.”

   reviewerLargest single victim loss approx $1.22M; admin wallets retain about 15%; ENS names and addresses for elevendrainer.eth and eleventeam.ethMatches the cited source. Addresses and inflow figures beyond these were not independently verified on-chain.
   citedwww.bitbbq.com/en/304625/
2. #4[confirmed][no action needed]in section: Overview and Classification

   “Attribution to Russian-linked operators has been alleged by community researchers, though this has not been confirmed by a law enforcement or Tier 1 security firm as of the date of this investigation.”

   reviewerAlleged Russian attribution, unconfirmed by law enforcementHedged correctly.
   citedwww.bitbbq.com/en/304625/
3. #6[confirmed][no action needed]in section: Aerodrome and Velodrome DNS Hijack (November 2025)

   “Blockaid reported that its network warned 408 users during wallet connection and 491 during transaction signing, preventing an estimated $3.5 million in losses.”

   reviewerAerodrome/Velodrome DNS hijack stole about $700K; Blockaid warned 408 and 491 users, preventing about $3.5M; detection at 21:31 UTC, remediation 22:40Verified against Blockaid blog.
   citedwww.blockaid.io/blog/how-blockaids-custo…drome-dns-attack
4. #9[confirmed][no action needed]in section: Gitcoin Subdomain Compromise (June 2026)

   “On June 21, 2026, blockchain security firm Blockaid detected a frontend attack on the Gitcoin subdomain files.gitcoin.co.”

   reviewerJune 21, 2026 Blockaid detected Eleven Drainer code on files.gitcoin.co; no loss figuresCorroborated by independent reports; no loss figures found.
   citedphemex.com/news/article/gitcoin-subdomai…cious-code-90167
5. #10[confirmed][no action needed]in the summary

   “As of June 2026, the kit remains active and was detected embedded in a compromised Gitcoin subdomain.”

   reviewerEleven Drainer remained active as of June 2026Supported through June 2026; nothing found on status since. Some reports attribute the Gitcoin/Yield Yak attacks to a different toolkit (AngelFerno) using the same method, so the attribution is contested.
   citedx.com/blockaid_/status/2068534795684946308