Fact-check findings
What an automated fact-checker found when it re-read Lucifer DaaS against the sources the page cites. Only the most recent review is shown.
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #7[unverifiable][awaiting moderator]in section: Ecosystem Context and Predecessor Drainers
“Scam Sniffer reported that wallet drainers stole $494 million in 2024 across 332,000 wallet addresses”
reviewerScam Sniffer, BlockSec, Check Point and Pink/Angel/Inferno figures in the ecosystem sectionsI did not independently fetch the industry statistics (Scam Sniffer, BlockSec, ACM, Check Point, Pink, Angel). They are background context and are not specific to Lucifer. I did not score them.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in the summary
“operators keep 20% of each successful drain and affiliates supplying phishing traffic keep 80%”
reviewerOperators keep 20% of each drain and affiliates keep 80%The 20% operator share is sourced. The 80% affiliate share is an inference from the arithmetic and is not stated in the article. - #2[partially supported][awaiting moderator]in section: Overview and Classification
“The platform runs on infrastructure and affiliate networks separate from other named drainer operations such as Inferno, Vanilla, Angel, Quark, Pink and MS Drainer”
reviewerLucifer runs on infrastructure separate from Inferno, Vanilla, Angel, Quark, Pink and MS DrainerThe BleepingComputer article names only some of the listed brands. The page notes that its input pages differ, so the rest may come from the uncited Flare report.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #3[confirmed][no action needed]in section: Operational Resilience and Infrastructure
“In August 2025 Telegram banned the operation's automated bots”
reviewerTelegram banned Lucifer bots in August 2025 and affiliates created replacement bots with admin privilegesMatches the article. - #4[confirmed][no action needed]in section: Operational Resilience and Infrastructure
“In November 2025 a documentation domain hosted on Google Firebase was suspended, reportedly after exposure in security research.”
reviewerA Firebase documentation domain was suspended in November 2025 and documentation moved to IPFSMatches the article. - #5[confirmed][no action needed]in section: Technical Capabilities and Version History
“In March 2025 the operators announced version 6.6.6 of the drainer”
reviewerVersion 6.6.6 was announced in March 2025 with Permit2 abuse and multichain supportMatches the article. - #6[confirmed][no action needed]in section: Overview and Classification
“Flare researchers analyzed approximately 700 posts collected from underground forums, chats, channels and Telegram communities associated with Lucifer DaaS between January 2025 and early 2026”
reviewerFlare analyzed about 700 posts from January 2025 to early 2026Matches the article. The article was published on 2026-05-21.