Fact-check findings

The cited evidence supports part of the claim but not all of it.

1. #4[partially supported][awaiting moderator]in section: Phishing Infrastructure and Attack Methodology

   “(and in some accounts up to 229)”

   reviewerPhishing sites impersonated up to 229 brands in some accountsThe over-100 figure is supported. I could not find 229 in the Group-IB or Hacker News sources (the Infosecurity article was not fetched).
   citedwww.group-ib.com/blog/inferno-drainer/www.infosecurity-magazine.com/news/infer…oofs-100-crypto/
2. #5[partially supported][awaiting moderator]in section: Shutdown, Relaunch, and Continuity

   “Group-IB noted that the administrative panel remained operational as late as January 2024, and smart contracts deployed as far back as September 9, 2023, continued to be actively used.”

   reviewerSmart contracts deployed on September 9, 2023 continued to be used (attributed to Group-IB in prose)The fact is true but the Sept 9 2023 detail comes from Check Point, not Group-IB as the sentence attributes it.
   citedwww.group-ib.com/blog/inferno-drainer/research.checkpoint.com/2025/inferno-dra…-crypto-drainer/
3. #6[partially supported][awaiting moderator]in section: Drainer-as-a-Service Industry Context

   “The operation deployed over 500 variants of fake token contracts on Ethereum alone.”

   reviewerOperation deployed over 500 variants of fake token contracts on Ethereum aloneI found no source for 500 fake token contract variants. It may be a mix-up with the 500+ websites figure.
   citedwww.group-ib.com/blog/inferno-drainer/research.checkpoint.com/2025/inferno-dra…-crypto-drainer/
4. #8[partially supported][awaiting moderator]in the timeline

   “https://www.blockaid.io/blog/putting-inferno-drainer-group-out-of-business”

   reviewerOctober 2024 shutdown announcement and transfer to Angel Drainer, cited to the Blockaid blogSearch results from Cryptorank, Cointelegraph and BeInCrypto report the October 2024 handover (Scam Sniffer, about October 19). I only saw them as search snippets, so the claim itself is plausible. The cited source does not support it. Swap in a source that does; I did not fetch one, so I give no replacement URL.
   citedwww.blockaid.io/blog/putting-inferno-dra…-out-of-business
5. #10[partially supported][awaiting moderator]in the timeline

   “2023-11-10”

   reviewerHacker News attributes $80-88M and 134,000-137,000 victims; timeline dates this 2023-11-10The figures are supported. The specific day 2023-11-10 is not found in the cited source, so the date appears to be an invention. I have no sourced replacement date.
   citedthehackernews.com/2024/01/inferno-malwar…as-coinbase.html
6. #11[partially supported][awaiting moderator]in the timeline

   “First tracked phishing websites deployed by Inferno Drainer affiliates, per Scam Sniffer forensics.”

   reviewerFirst tracked phishing sites deployed March 27, 2023Mildly overstated. The February 2023 start, $5.9M, 4,888 victims and 689 sites are confirmed. The 80/20 split is the base rate, and the page already notes the 30% variant.
   citedwww.bleepingcomputer.com/news/security/c…ands-of-victims/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Shutdown, Relaunch, and Continuity

   “Check Point Research published findings in May 2025 confirming that Inferno Drainer had remained operational and had compromised over 30,000 new unique wallet addresses between September 2024 and March 2025, resulting in at least $9 million in additional losses during that six-month window alone.”

   reviewerCheck Point Research (May 2025) found 30,000+ new victims and at least $9M in losses between September 2024 and March 2025Matches the Check Point report.
   citedresearch.checkpoint.com/2025/inferno-dra…-crypto-drainer/
2. #2[confirmed][no action needed]in section: Technical Evolution and Anti-Detection Evasion (2024-2025)

   “The largest single documented theft in the 2024-2025 phase involved 107.8 billion PEPE tokens, valued at approximately $761,068 to $1.2 million at time of theft.”

   reviewerContract addresses and technical details (receiver contract, BSC config contract, 107.8B PEPE theft, 5-10 MB scripts, four-layer AES) per Check PointThe page's range covers both valuations. The report says 'four layers' applies to client requests only, and the page does not make that distinction (minor).
   citedresearch.checkpoint.com/2025/inferno-dra…-crypto-drainer/
3. #3[confirmed][no action needed]in section: Phishing Infrastructure and Attack Methodology

   “Group-IB's Threat Intelligence platform identified more than 16,000 unique domains linked to the operation.”

   reviewerGroup-IB figures on domains, Seaport/WalletConnect/Coinbase sites, 80/20 and 30% split, $100 threshold, Telegram creation date, panel active January 2024All Group-IB-derived figures I checked match.
   citedwww.group-ib.com/blog/inferno-drainer/
4. #7[confirmed][no action needed]in the timeline

   “Inferno Drainer publicly announces resumption of operations, citing Pink Drainer's exit and increased demand.”

   reviewerResumption announced May 2024 with $125M claim, $250M cumulative total, 28 chains, citing Pink Drainer exitThe page correctly hedges the $250M figure as self-reported. The sum (about $80M + $125M) does not reach $250M, which supports that hedge.
   citedcryptoslate.com/inferno-drainer-resumes-…om-crypto-users/
5. #9[confirmed][no action needed]in section: Blockchain Forensics and On-Chain Attribution

   “Blockaid's proprietary dApp scanning and transaction simulation contributed to protecting wallets and was credited by Blockaid with helping disrupt Inferno Drainer's operations.”

   reviewerBlockaid credited with helping disrupt Inferno Drainer's operationsThe page already frames this as Blockaid's own credit.
   citedwww.blockaid.io/blog/putting-inferno-dra…-out-of-business