Lucifer Drainer
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5wysEF…Ac5cSummary
Lucifer Drainer is a criminal drainer-as-a-service (DaaS) platform that industrializes cryptocurrency wallet theft through a structured affiliate model. Active since at least early 2025, it operates by providing affiliates with phishing kits, automated site-cloning tools, and commission-split infrastructure (operators retain 20% per successful drain) while affiliates supply phishing traffic. Despite Telegram bot bans in August 2025 and documentation domain suspension in November 2025, the operation migrated to IPFS and remained active as of May 2026, making it one of the most operationally resilient drainer platforms in the current threat landscape.
Connected Entities
1 entitiesTimeline(10 events)
November 2023
Inferno Drainer announces shutdown after claiming over $80 million in total theft; later found to have continued operations covertly.
Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNews17 May 2024
Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.
Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto17 July 2024
Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.
Angel Drainer App Shuts Down After Developer Identification — CryptoTimes19 October 2024
Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team, consolidating two of the largest DaaS operations.
Angel Drainer Absorbs Inferno's Toolkit — CryptoRank2025
Flare researchers begin collecting and analyzing approximately 700 underground posts from forums, chats, and channels related to Lucifer DaaS; research period spans January 2025 through early 2026.
Inside a Crypto Drainer — Bleeping ComputerMarch 2025
Lucifer Drainer announces version 6.6.6 featuring ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses, and multichain deployment.
Inside a Crypto Drainer — Bleeping ComputerMay 2025
Lucifer Drainer operators publicly restate the commission-only model: 'We do not sell or lease the software and only split 20% per hit.'
Inside a Crypto Drainer — Bleeping ComputerAugust 2025
Telegram bans Lucifer Drainer bots. Operators instruct affiliates via channel to create new bots and grant them admin privileges, maintaining continuity.
Inside a Crypto Drainer — Bleeping ComputerNovember 2025
Documentation domain hosted on Google Firebase suspended following security research exposure. Lucifer Drainer migrates documentation to IPFS, citing decentralization as a takedown-resistance strategy.
Inside a Crypto Drainer — Bleeping Computer21 May 2026
Bleeping Computer publishes deep-dive on Lucifer Drainer's internal operations, confirming the platform remains live and actively recruiting affiliates as of May 2026.
Inside a Crypto Drainer — Bleeping ComputerDecision Log
- hash: A2KzH6E72y9nrnRBjgXZnaFsLYSVYBaBw9hhaYZfZQNv
- hash: 6YsRZr5w783MdbtJUr3WiPpteHUTMv4Y51QrGrqpmdDq
- hash: 6BShEfFLnWs1sLy4SgCowvRjPca3Uanx3FWj7GskbKQC
This investigation is cryptographically anchored to the Solana blockchain (3 events). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:04:13 PM
last updated: 9/1/2026, 4:44:56 AM
avoid.net — verified advice for a post-truth world