Rublevka Team
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3VJZfk…vfDwSummary
Rublevka Team is a Russian-speaking, affiliate-driven drainer-as-a-service operation active since 2023 that has documented over $10.9 million in cryptocurrency theft across at least 240,000 wallet drain events. The group operates primarily on the Solana blockchain as of spring 2025 and markets its tooling to low-skill affiliates through Telegram bots and Russian-language cybercrime forums. No law enforcement actions or sanctions had been publicly reported as of the date of this investigation.
Connected Entities
10 entities · 60 linked investigations- Rublevka Team→mentioned with→Backpack(60%)
- Rublevka Team→mentioned with→CoinEx(60%)
- Rublevka Team→mentioned with→Coinbase(60%)
- Rublevka Team→mentioned with→Phantom Wallet(80%)
- Rublevka Team→mentioned with→KuCoin(60%)
- Rublevka Team→mentioned with→Bitget(70%)
- Rublevka Team→mentioned with→Trezor(60%)
- Rublevka Team→mentioned with→Solana(80%)
- Rublevka Team→mentioned with→Helius(60%)
- Phantom Wallet→mentioned with→Solana(80%)
- + 7 more
1 submission awaiting moderator review.
Timeline(9 events)
2023
Rublevka Team founded on LolzTeam Forum by alias 'denisssss_inactive'; initial phase operates fake cryptocurrency exchanges to harvest victim funds.
Recorded Future Insikt Group CTA-2026-0204May 2024
Telegram main chat '[RublevkaTeam] Chat' activity begins (messages documented from May 2024 onward). Group pivots from fake exchanges to custom JavaScript drainer targeting TON blockchain airdrop lures.
Recorded Future Insikt Group CTA-2026-0204April 2025
Rublevka Team abandons TON and pivots to Solana. Over 900 new domains registered in connection with SOL drainer infrastructure beginning this month.
Recorded Future Insikt Group CTA-2026-020418 April 2025
Alias 'denisssss_inactive' posts latest recruitment advertisement for the SOL drainer affiliate program on LolzTeam Forum.
Recorded Future Insikt Group CTA-2026-0204August 2025
Recorded Future Insikt Group begins active monitoring of Rublevka Team operations.
Recorded Future Insikt Group CTA-2026-0204September 2025
Rublevka Team begins using X (Twitter) as a distribution vector through compromised Web3-branded accounts, interspersing malicious dApp links among legitimate reposts.
Recorded Future Insikt Group CTA-2026-0204; Blockaid Blog8 December 2025
Total documented revenue surpasses $10.9 million across 240,000+ wallet drain events, based on Insikt Group monitoring of the Rublevka Telegram profits channel.
Recorded Future Insikt Group CTA-2026-0204December 2025
Continuous disruptions to Rublevka Team's shared domain hosting service begin, extending into early 2026, causing operational friction but not cessation of activity.
Recorded Future Insikt Group CTA-2026-02044 February 2026
Recorded Future Insikt Group publishes 'Rublevka Team: Anatomy of a Russian Crypto Drainer Operation' (CTA-2026-0204), the first major public intelligence disclosure on the group.
Recorded Future Insikt Group CTA-2026-0204Decision Log
- slot 422413815 · hash 9DV5YAWwGqyNLyXVHNL6e7f3TJH5jSNYUQpKg5RsFCss
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 9 of 10 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/27/2026, 2:44:35 AM
last updated: 5/27/2026, 2:44:35 AM
11 viewsavoid.net — verified advice for a post-truth world