Lucifer Drainer
Last changed 2026-10-15 · Correction — Fact-check correction applied (the reviewer found the claim disputed): "Inferno Drainer claimed responsibility for $250 million in total thefts when it announced a shutdown in November 2023." Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5wysEF…Ac5cSummary
Lucifer Drainer is a criminal drainer-as-a-service (DaaS) platform that industrializes cryptocurrency wallet theft through a structured affiliate model. Active since at least early 2025, it operates by providing affiliates with phishing kits, automated site-cloning tools, and commission-split infrastructure (operators retain 20% per successful drain) while affiliates supply phishing traffic. Despite Telegram bot bans in August 2025 and documentation domain suspension in November 2025, the operation migrated to IPFS and remained active as of May 2026, making it one of the most operationally resilient drainer platforms in the current threat landscape.
Connected Entities
4 entities · 60 linked investigations- Lucifer Drainer→mentioned with→Ethereum(65%)
- Lucifer Drainer→mentioned with→Inferno Drainer(80%)
- Lucifer Drainer→mentioned with→Lucifer DaaS(80%)
- Inferno Drainer→mentioned with→Ethereum(70%)
- Lucifer DaaS→mentioned with→Lucifer Drainer(80%)
- Lucifer DaaS→mentioned with→Ethereum(80%)
- Lucifer DaaS→mentioned with→Inferno Drainer(80%)
Timeline(10 events)
November 2023
Inferno Drainer announces shutdown after claiming over $80 million in total theft; later found to have continued operations covertly.
Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNews17 May 2024
Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.
Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto17 July 2024
Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.
Angel Drainer App Shuts Down After Developer Identification — CryptoTimes19 October 2024
Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team, consolidating two of the largest DaaS operations.
Angel Drainer Absorbs Inferno's Toolkit — CryptoRank2025
Flare researchers begin collecting and analyzing approximately 700 underground posts from forums, chats, and channels related to Lucifer DaaS; research period spans January 2025 through early 2026.
Inside a Crypto Drainer — Bleeping ComputerMarch 2025
Lucifer Drainer announces version 6.6.6 featuring ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses, and multichain deployment.
Inside a Crypto Drainer — Bleeping ComputerMay 2025
Lucifer Drainer operators publicly restate the commission-only model: 'We do not sell or lease the software and only split 20% per hit.'
Inside a Crypto Drainer — Bleeping ComputerAugust 2025
Telegram bans Lucifer Drainer bots. Operators instruct affiliates via channel to create new bots and grant them admin privileges, maintaining continuity.
Inside a Crypto Drainer — Bleeping ComputerNovember 2025
Documentation domain hosted on Google Firebase suspended following security research exposure. Lucifer Drainer migrates documentation to IPFS, citing decentralization as a takedown-resistance strategy.
Inside a Crypto Drainer — Bleeping Computer21 May 2026
Bleeping Computer publishes deep-dive on Lucifer Drainer's internal operations, confirming the platform remains live and actively recruiting affiliates as of May 2026.
Inside a Crypto Drainer — Bleeping ComputerDecision Log
- slot 457327577 · hash Az4Fjn4cjtFogPcVDYEPLHG9k2kvek5Bt12P24r3ZiPj
- slot 445607276 · hash 4PNuVdzTBT9tsj1LsMzedQtQAuUJ9kwqJg3w762Zr2mY
- slot 423946111 · hash A2KzH6E72y9nrnRBjgXZnaFsLYSVYBaBw9hhaYZfZQNv
- slot 423946105 · hash 6YsRZr5w783MdbtJUr3WiPpteHUTMv4Y51QrGrqpmdDq
- slot 423878425 · hash 6BShEfFLnWs1sLy4SgCowvRjPca3Uanx3FWj7GskbKQC
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 12 of 13 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:04:13 PM
last updated: 10/15/2026, 5:52:02 PM
88 viewsavoid.net — verified advice for a post-truth world