Rublevka Team
Summary
Rublevka Team is a Russian-speaking, affiliate-driven drainer-as-a-service operation active since 2023 that has documented over $10.9 million in cryptocurrency theft across at least 240,000 wallet drain events. The group operates primarily on the Solana blockchain as of spring 2025 and markets its tooling to low-skill affiliates through Telegram bots and Russian-language cybercrime forums. No law enforcement actions or sanctions had been publicly reported as of the date of this investigation.
Connected Entities
1 entities · 10 linked investigationsCommunity submissions
- Under reviewincriminatingWayback pending6/2/2026, 7:36:57 PM
“Recorded Future Insikt Group anatomy report (February 2026) naming operators, wallet addresses, and C2 domains, confirming $10.9M+ lifetime theft with active Solana infrastructure — material new development beyond original AVOID.NET entry”
— avoid-scout
Timeline(9 events)
2023-01-01
Rublevka Team founded on LolzTeam Forum by alias 'denisssss_inactive'; initial phase operates fake cryptocurrency exchanges to harvest victim funds.
Recorded Future Insikt Group CTA-2026-02042024-05-01
Telegram main chat '[RublevkaTeam] Chat' activity begins (messages documented from May 2024 onward). Group pivots from fake exchanges to custom JavaScript drainer targeting TON blockchain airdrop lures.
Recorded Future Insikt Group CTA-2026-02042025-04-01
Rublevka Team abandons TON and pivots to Solana. Over 900 new domains registered in connection with SOL drainer infrastructure beginning this month.
Recorded Future Insikt Group CTA-2026-02042025-04-18
Alias 'denisssss_inactive' posts latest recruitment advertisement for the SOL drainer affiliate program on LolzTeam Forum.
Recorded Future Insikt Group CTA-2026-02042025-08-01
Recorded Future Insikt Group begins active monitoring of Rublevka Team operations.
Recorded Future Insikt Group CTA-2026-02042025-09-01
Rublevka Team begins using X (Twitter) as a distribution vector through compromised Web3-branded accounts, interspersing malicious dApp links among legitimate reposts.
Recorded Future Insikt Group CTA-2026-0204; Blockaid Blog2025-12-08
Total documented revenue surpasses $10.9 million across 240,000+ wallet drain events, based on Insikt Group monitoring of the Rublevka Telegram profits channel.
Recorded Future Insikt Group CTA-2026-02042025-12-01
Continuous disruptions to Rublevka Team's shared domain hosting service begin, extending into early 2026, causing operational friction but not cessation of activity.
Recorded Future Insikt Group CTA-2026-02042026-02-04
Recorded Future Insikt Group publishes 'Rublevka Team: Anatomy of a Russian Crypto Drainer Operation' (CTA-2026-0204), the first major public intelligence disclosure on the group.
Recorded Future Insikt Group CTA-2026-0204Decision Log
- hash: 9DV5YAWwGqyNLyXVHNL6e7f3TJH5jSNYUQpKg5RsFCss
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/27/2026, 2:44:35 AM
last updated: 5/27/2026, 2:45:32 AM
avoid.net — verified advice for a post-truth world