Audit log

Every state-changing event for Quark Drainer: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-04 12:35:48Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   GxZcrLcZ8eAr…oCQEptMGcopysha256 → base58

   verifying row…

   canonical bytes (21248 B) ▸

   {"actor":"system:backfill","investigation_id":"083dd2eb-bd54-452d-884d-96a3b2872725","kind":"publish","page_slug":"quark-drainer","published_at":"2026-08-04T12:35:48.737Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Quark Drainer","sections":[{"content":"Quark Drainer is a multi-chain cryptocurrency wallet-draining toolkit sold by an entity operating as Quark Lab. Unlike competing DaaS platforms that levy a 15–25% commission on stolen funds, Quark Lab advertises a flat-fee model: a one-time license of $5,000 grants the buyer backend source code, a frontend interface, smart contract components, and access to a private community of alleged 200+ users. A monthly optional donation of $100 is described as a development contribution. This no-commission structure is presented as a competitive differentiator against platforms such as Inferno Drainer (15–20% cut) and Angel Drainer (20% cut). The toolkit is marketed across Telegram channels (@quark_drainer, @quarkdrainer) and multiple English- and Russian-language cybercrime forums including crdpro.org, crdweb.cc, crdworld.biz, and carder.market. An earlier credit option offered hosting of the backend by the developer for a $2,000 down payment.","heading":"Overview and Operating Model","severity":"critical","sources":[{"credibility":3,"name":"Quark Drainer carding forum advertisement — crdweb.cc (July 2026)","type":"community_report","url":"https://www.crdweb.cc/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.12807/"},{"credibility":3,"name":"Quark Drainer carding forum advertisement — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.28774/"},{"credibility":3,"name":"Quark Drainer early advertisement with pricing — ewebdiscussion.com (November 2023)","type":"community_report","url":"https://www.ewebdiscussion.com/threads/quark-drainer-seaport-blur-x2y2-fix-metamask-permit-2-smart-contract.211478/"},{"credibility":2,"name":"Drainer-as-a-Service (DaaS) — Ledger Academy","type":"research","url":"https://www.ledger.com/academy/glossary/drainer-as-a-service-daas"}]},{"content":"According to operator advertisements and security research from Blockaid, Quark Drainer supports more than 90 blockchain networks and approximately 480 compatible wallets as of mid-2026. Primary chain coverage includes all EVM-compatible networks (Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Fantom), Solana, TON, TRON, and XRP. Compatible wallets span MetaMask, Trust Wallet, Coinbase Wallet, Binance Wallet (EVM); Phantom, Solflare, Exodus (Solana); Tonkeeper, MyTonWallet (TON); TronLink (TRON); and Xaman (XRP). Asset extraction methods documented across forum advertisements include: Transfer, Approve, Permit (ERC-2612), Permit2 (Uniswap), Seaport 1.5, SetApprovalForAll, Blur and X2Y2 marketplace signatures, Smart Contract calls, Claim, Multicall, and Swap. The toolkit allegedly bypasses transaction simulation tools including WalletGuard, Pocket Universe, and Blockaid's own detection layer. Smart contracts deployed by affiliates are described as self-sustaining with no expiration, making post-deployment revocation difficult. The package includes 400+ pre-built phishing landing pages optimized for mobile and desktop, including airdrop impersonation pages targeting newly launched blockchain projects. Blockaid's research specifically identified Quark Lab as producing airdrop landing pages designed to impersonate new chain launches, exploiting the high-attention windows surrounding mainnet events. Real-time victim notifications are delivered directly to the affiliate's Telegram account via a built-in bot.","heading":"Technical Capabilities and Supported Chains","severity":"critical","sources":[{"credibility":2,"name":"How Wallet Drainers Exploit New Blockchain Launches — Blockaid Blog","type":"research","url":"https://www.blockaid.io/blog/how-wallet-drainers-exploit-new-blockchain-launches"},{"credibility":3,"name":"Quark Drainer advertisement — crdweb.cc (July 2026)","type":"community_report","url":"https://www.crdweb.cc/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.12807/"},{"credibility":3,"name":"Quark Drainer early advertisement — ewebdiscussion.com (November 2023)","type":"community_report","url":"https://www.ewebdiscussion.com/threads/quark-drainer-seaport-blur-x2y2-fix-metamask-permit-2-smart-contract.211478/"}]},{"content":"Security firm Blockaid, in its blog post analyzing how wallet drainers exploit new blockchain launches, described Quark Lab as 'the most prolific drainer operation observed in this dataset.' The firm noted Quark operates across Telegram and cybercrime forums and offers a comprehensive criminal toolkit encompassing cross-platform infostealers for Windows and macOS, drainers covering more than 70 blockchains and 480 wallets, and ready-made phishing templates. Blockaid specifically highlighted Quark's ability to support EVM, Solana, TON, and Tron chains as demonstrating significant engineering capability. This designation as the most active drainer in Blockaid's tracked dataset places Quark Lab above better-known prior platforms such as Inferno Drainer and Angel Drainer in terms of current operational scale, though total theft attributable specifically to Quark Drainer affiliates has not been publicly quantified by a Tier 1 or Tier 2 source. The broader DaaS ecosystem accounted for an estimated $1.93 billion in losses in the first half of 2025 according to PhishDestroy research.","heading":"Quark Lab as Most Prolific Drainer Operation (Blockaid Finding)","severity":"critical","sources":[{"credibility":2,"name":"How Wallet Drainers Exploit New Blockchain Launches — Blockaid Blog","type":"research","url":"https://www.blockaid.io/blog/how-wallet-drainers-exploit-new-blockchain-launches"},{"credibility":2,"name":"Anatomy of a Crypto Drainer: How $1.93B Vanished in 6 Months — PhishDestroy","type":"research","url":"https://phishdestroy.io/crypto-drainer-anatomy"}]},{"content":"In addition to the wallet draining component, Quark Lab also offers a product called Quark Stealer, a cross-platform infostealer targeting both Windows and macOS systems. Intel 471 documented that in April 2024 the actor operating as QuarkLab introduced a Malware-as-a-Service offering that included both a drainer and an infostealer capable of extracting Keychain passwords, browser data, and cryptocurrency wallet credentials from macOS machines. This offering was priced at $3,000 per month at the time of Intel 471's reporting. KELA Cyber's 2025 report on the rise of macOS infostealers identified Quark Stealer as one of two featured case studies, noting that underground market activity for macOS-targeting infostealers peaked in 2025. The dual product line — combining a wallet drainer with an infostealer — positions Quark Lab as a full-spectrum credential and crypto theft platform, distinguishing it from single-product competitors.","heading":"Quark Stealer — Companion Infostealer Component","severity":"critical","sources":[{"credibility":2,"name":"macOS Is Increasingly Targeted by Threat Actors — Intel 471","type":"research","url":"https://www.intel471.com/blog/macos-is-increasingly-targeted-by-threat-actors"},{"credibility":2,"name":"The Rise of macOS Infostealers: 2025 in Review — KELA Cyber","type":"research","url":"https://www.kelacyber.com/resources/research/the-rise-of-macos-infostealers-2025-in-review/"}]},{"content":"Quark Drainer is distributed via a network of Telegram channels and cybercrime forums. Known Telegram presences include @quark_drainer (primary channel, handle @quarkgod) and @quarkdrainer (backup channel). The operator also maintains a YouTube channel at @QuarkCryptoDrainer and an Instagram account at @quarkdrainers, indicating use of mainstream social media for promotion. Primary web presences have included quarkdrainer.cc, quarklab.cc, and quarklab.app, with documentation hosted on quarklab.gitbook.io. These domains are subject to periodic change. The toolkit is sold exclusively on an access-controlled basis requiring license verification, which the operator claims limits distribution to vetted buyers. A private Telegram community of alleged 200+ active users serves as an affiliate support channel. The operator also advertises presence on carder and cracking forums including crdpro.org, carder.market, crackingx.com, and emucoach.com.","heading":"Distribution Channels and Infrastructure","severity":"high","sources":[{"credibility":3,"name":"Quark Drainer Telegram channel — Telemetr.io entry (@quarkgod)","type":"other","url":"https://telemetr.io/en/channels/1588128840-quark_drainer"},{"credibility":3,"name":"Quark Lab — YouTube channel","type":"other","url":"https://www.youtube.com/@QuarkCryptoDrainer"},{"credibility":3,"name":"Quark Drainer — Instagram (@quarkdrainers)","type":"social_media","url":"https://www.instagram.com/quarkdrainers/"},{"credibility":3,"name":"Quark Drainer advertisement — carder.market","type":"community_report","url":"https://carder.market/threads/quark-drainer-evm-sol-trx-ton-nft-private-script-1-crypto-drainer.167149/"}]},{"content":"Quark Drainer operates within a commoditized drainer-as-a-service economy. According to security research, wallet drainer phishing losses across the broader ecosystem reached approximately $494 million in 2024 (Scam Sniffer) before falling to approximately $84 million in 2025 — an 83% decline attributed to improved detection and the takedown of predecessor platforms. However, Blockaid's H1 2026 report recorded $1.1 billion in total on-chain exploit losses across 212 incidents, indicating that theft activity has rebounded significantly. The DaaS market generally operates on affiliate models where platform operators earn 5–25% commissions on stolen funds; Quark's flat-fee model is an outlier. Predecessor platforms that Quark Drainer has outlasted include Inferno Drainer (shut down November 2023, re-emerged 2024), Angel Drainer (shut down March 2024), and Pink Drainer (retired May 2024). No shutdown, exit, or law enforcement action targeting Quark Drainer specifically has been publicly reported as of August 2026.","heading":"Broader DaaS Ecosystem Context","severity":"high","sources":[{"credibility":2,"name":"Wallet Drainer Phishing Losses Fall to $84M in 2025, Down 83% — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/wallet-drainer-phishing-losses-fall-to-84m-in-2025-down-83/"},{"credibility":2,"name":"Crypto Security Losses Hit $1.1B in H1 2026: Blockaid Report — crypto.news","type":"news_article","url":"https://crypto.news/crypto-security-losses-hit-1-1b-in-h1-2026-blockaid-report/"},{"credibility":2,"name":"Scam Sniffer 2024: Web3 Phishing Attacks — Wallet Drainers Drain $494 Million","type":"research","url":"https://defihacklabs.substack.com/p/scam-sniffer-2024-web3-phishing-attacks"},{"credibility":2,"name":"Rise in Drainer-as-a-Service Attacks Lead to High-Profile Breaches — SecurityBrief Asia","type":"news_article","url":"https://securitybrief.asia/story/rise-in-drainer-as-a-service-attacks-lead-to-high-profile-breaches"}]},{"content":"The operators behind Quark Lab have not been publicly identified or attributed to specific individuals by any law enforcement agency or Tier 1 security research firm as of August 2026. The Telegram contact handles @quarkdev and @quarkdrainer have been used in forum advertisements. No arrests, indictments, or OFAC sanctions specifically naming Quark Lab or its operators have been located. The platform's use of Telegram for distribution, closed-access licensing, and anonymized cryptocurrency transactions makes attribution difficult. Intel 471 tracked the actor as 'QuarkLab' in its underground market monitoring beginning in April 2024 but did not publish a real-world identity attribution. The operator has maintained consistent branding across multiple domains (quarkdrainer.cc, quarklab.cc, quarklab.app) and documentation platforms (gitbook.io), suggesting a single persistent operator or small team.","heading":"Operator Identity and Attribution","severity":"medium","sources":[{"credibility":2,"name":"macOS Is Increasingly Targeted by Threat Actors — Intel 471","type":"research","url":"https://www.intel471.com/blog/macos-is-increasingly-targeted-by-threat-actors"},{"credibility":3,"name":"Quark Drainer official website","type":"official","url":"https://quarkdrainer.cc/"}]},{"content":"Quark Drainer targets retail cryptocurrency users who interact with phishing pages impersonating legitimate decentralized applications, airdrop claim portals, NFT minting sites, exchange interfaces, and newly launched blockchain projects. The toolkit's priority drainage order — targeting ETH, USDT, USDC, BNB, DAI, SOL, XRP, SHIBA, TRX first — indicates a focus on liquid, high-value assets. Mobile users are specifically targeted through cross-device optimized templates. The use of wallet approval patterns (Permit, Permit2, Approve, SetApprovalForAll) means victims may unknowingly sign transactions that grant the drainer smart contract unlimited spending authority on their wallets without an immediate visible fund transfer. The autonomous smart contracts deployed have no expiration, meaning wallets that granted approvals remain at risk even after the phishing site is taken down. Users of MetaMask, Trust Wallet, Phantom, and WalletConnect-compatible wallets face the widest exposure given Quark's coverage of these connection protocols.","heading":"Victim Risk Profile","severity":"critical","sources":[{"credibility":2,"name":"How Wallet Drainers Exploit New Blockchain Launches — Blockaid Blog","type":"research","url":"https://www.blockaid.io/blog/how-wallet-drainers-exploit-new-blockchain-launches"},{"credibility":3,"name":"Quark Drainer advertisement — crdweb.cc (July 2026)","type":"community_report","url":"https://www.crdweb.cc/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.12807/"},{"credibility":2,"name":"Drainer-as-a-Service (DaaS) — Ledger Academy","type":"research","url":"https://www.ledger.com/academy/glossary/drainer-as-a-service-daas"}]}],"sources_used":[{"credibility":2,"name":"How Wallet Drainers Exploit New Blockchain Launches — Blockaid Blog","type":"research","url":"https://www.blockaid.io/blog/how-wallet-drainers-exploit-new-blockchain-launches"},{"credibility":2,"name":"macOS Is Increasingly Targeted by Threat Actors — Intel 471","type":"research","url":"https://www.intel471.com/blog/macos-is-increasingly-targeted-by-threat-actors"},{"credibility":2,"name":"The Rise of macOS Infostealers: 2025 in Review — KELA Cyber","type":"research","url":"https://www.kelacyber.com/resources/research/the-rise-of-macos-infostealers-2025-in-review/"},{"credibility":2,"name":"Crypto Security Losses Hit $1.1B in H1 2026: Blockaid Report — crypto.news","type":"news_article","url":"https://crypto.news/crypto-security-losses-hit-1-1b-in-h1-2026-blockaid-report/"},{"credibility":2,"name":"Wallet Drainer Phishing Losses Fall to $84M in 2025, Down 83% — CryptoNews","type":"news_article","url":"https://cryptonews.com/news/wallet-drainer-phishing-losses-fall-to-84m-in-2025-down-83/"},{"credibility":2,"name":"Anatomy of a Crypto Drainer: How $1.93B Vanished in 6 Months — PhishDestroy","type":"research","url":"https://phishdestroy.io/crypto-drainer-anatomy"},{"credibility":2,"name":"Rise in Drainer-as-a-Service Attacks Lead to High-Profile Breaches — SecurityBrief Asia","type":"news_article","url":"https://securitybrief.asia/story/rise-in-drainer-as-a-service-attacks-lead-to-high-profile-breaches"},{"credibility":2,"name":"Drainer-as-a-Service (DaaS) — Ledger Academy","type":"research","url":"https://www.ledger.com/academy/glossary/drainer-as-a-service-daas"},{"credibility":2,"name":"Scam Sniffer 2024: Web3 Phishing Attacks — Wallet Drainers Drain $494 Million","type":"research","url":"https://defihacklabs.substack.com/p/scam-sniffer-2024-web3-phishing-attacks"},{"credibility":3,"name":"Quark Drainer advertisement — crdweb.cc (July 2026)","type":"community_report","url":"https://www.crdweb.cc/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.12807/"},{"credibility":3,"name":"Quark Drainer advertisement — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.28774/"},{"credibility":3,"name":"Quark Drainer early advertisement — ewebdiscussion.com (November 2023)","type":"community_report","url":"https://www.ewebdiscussion.com/threads/quark-drainer-seaport-blur-x2y2-fix-metamask-permit-2-smart-contract.211478/"},{"credibility":3,"name":"Quark Drainer advertisement — crdpro.org","type":"community_report","url":"https://crdpro.org/threads/quark-drainer-evm-sol-trx-ton-nft-private-script-1-crypto-drainer.64514/"},{"credibility":3,"name":"Quark Drainer advertisement — carder.market","type":"community_report","url":"https://carder.market/threads/quark-drainer-evm-sol-trx-ton-nft-private-script-1-crypto-drainer.167149/"},{"credibility":3,"name":"Quark Lab GitBook documentation index","type":"official","url":"https://quarklab.gitbook.io/quark-lab"},{"credibility":3,"name":"Quark Drainer official website (quarkdrainer.cc)","type":"official","url":"https://quarkdrainer.cc/"},{"credibility":2,"name":"Crypto Wallet Drainers — Group-IB Knowledge Hub","type":"research","url":"https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/"},{"credibility":1,"name":"Unmasking the Shadow Economy: DaaS Phishing on Ethereum — ACM IMC 2025","type":"research","url":"https://dl.acm.org/doi/10.1145/3730567.3764476"},{"credibility":2,"name":"State of Drainers Vol. 1 — Security Alliance","type":"research","url":"https://www.securityalliance.org/news/2025-10-drainers-vol-1"}],"summary":"Quark Drainer is a commercially distributed Drainer-as-a-Service (DaaS) toolkit operated under the brand Quark Lab. First advertised on cybercrime forums in late 2023, it supports wallet draining across more than 70 blockchains and 480 wallets — including EVM chains, Solana, TON, TRON, and XRP — and is sold for a flat fee of $5,000 with no ongoing revenue-share commission to operators. Security researchers at Blockaid identified Quark Lab as the most prolific drainer operation observed in their 2025–2026 tracking dataset. No law enforcement action or OFAC designation against the operators has been publicly confirmed as of August 2026.","timeline":[{"date":"2023-11-02","event":"Earliest confirmed forum advertisement for Quark Drainer appears on ewebdiscussion.com, listing $5,000 pricing, EVM chain support, and Seaport/Permit2 capabilities. A $4,000 holiday discount was promoted for November 15, 2023.","source":"ewebdiscussion.com forum post","source_url":"https://www.ewebdiscussion.com/threads/quark-drainer-seaport-blur-x2y2-fix-metamask-permit-2-smart-contract.211478/"},{"date":"2024-04-01","event":"Intel 471 documents Quark Lab actor offering a combined Malware-as-a-Service package including the drainer and a cross-platform infostealer (Quark Stealer) targeting macOS, priced at $3,000/month for the infostealer component.","source":"Intel 471 blog — macOS Is Increasingly Targeted by Threat Actors","source_url":"https://www.intel471.com/blog/macos-is-increasingly-targeted-by-threat-actors"},{"date":"2025-01-01","event":"KELA Cyber reports underground market chatter for macOS infostealers, including Quark Stealer, peaked in 2025. The broader wallet drainer market recorded $84 million in losses for the full year — an 83% decline from 2024 — while Quark Lab continued active operations.","source":"KELA Cyber — The Rise of macOS Infostealers: 2025 in Review; CryptoNews","source_url":"https://cryptonews.com/news/wallet-drainer-phishing-losses-fall-to-84m-in-2025-down-83/"},{"date":"2025-10-01","event":"Security Alliance publishes State of Drainers Vol. 1, documenting the broader drainer ecosystem including operators such as Inferno, Rublevka, Eleven, and Vanilla. Quark Lab is tracked as active during this period by Blockaid.","source":"Security Alliance — State of Drainers Vol. 1","source_url":"https://www.securityalliance.org/news/2025-10-drainers-vol-1"},{"date":"2026-01-01","event":"Blockaid publishes findings identifying Quark Lab as the most prolific drainer operation in its tracking dataset, noting support for 70+ blockchains and 480 wallets. Airdrop phishing templates targeting new chain launches are specifically called out.","source":"Blockaid Blog — How Wallet Drainers Exploit New Blockchain Launches","source_url":"https://www.blockaid.io/blog/how-wallet-drainers-exploit-new-blockchain-launches"},{"date":"2026-07-09","event":"Updated Quark Drainer advertisement posted on crdweb.cc advertising support for 440+ wallets, 90+ networks, EVM, Solana, TON, TRON, XRP; 400+ landing pages; and a private community of 200+ users. Price remains $5,000.","source":"crdweb.cc carding forum advertisement","source_url":"https://www.crdweb.cc/threads/1-crypto-drainer-quark-drainer-evm-sol-trx-ton-xrp-nft-private-script.12807/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 243b8bf5-145c-4cd2-be57-2c5461fec426copy