Audit log

Every state-changing event for Sector Drainer — DaaS Wallet Drainer with Phantom 0-Day Bypass: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-04 23:18:58Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   9VFUgxZVgar1…UEzXnbkucopysha256 → base58

   verifying row…

   canonical bytes (24225 B) ▸

   {"actor":"system:backfill","investigation_id":"5502f2b2-6209-4f96-9683-1ddd6fb3c973","kind":"publish","page_slug":"sector-drainer-daas-wallet-drainer-with-phantom-0-day-bypass","published_at":"2026-08-04T23:18:58.292Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Sector Drainer — DaaS Wallet Drainer with Phantom 0-Day Bypass","sections":[{"content":"Sector Drainer is a full-stack crypto wallet draining toolkit marketed under a drainer-as-a-service (DaaS) business model. It was first reported by Dark Web Informer on March 18, 2026, after the operator — using the handle SectorD — posted an advertisement on multiple underground cybercrime and carding forums including crdworld.biz and carder.market. The service is positioned as a turnkey phishing and draining infrastructure aimed at lowering the barrier to entry for wallet theft across Ethereum, Solana, BNB Chain, and Tron networks. The threat actor's forum profile was created in March 2026 and carried only 1 post, 1 thread, and 0 reputation at the time of the listing — a profile consistent with either a newly registered actor or an established operator migrating to a new alias.","heading":"Overview and Discovery","severity":"critical","sources":[{"credibility":2,"name":"Sector Drainer Advertised as Crypto Wallet Drainer-as-a-Service With 0-Day Phantom Bypass — Dark Web Informer","type":"news_article","url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"credibility":2,"name":"Sector Drainer Crypto-Theft Kit Emerging on Dark Web Forums — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-alert-sector-drainer-crypto-theft-kit-emerging-on-dark-web-forums/"},{"credibility":3,"name":"Sector Drainer Forum Post — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.27046/"},{"credibility":3,"name":"Sector Drainer Forum Post — carder.market","type":"community_report","url":"https://carder.market/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.181982/"}]},{"content":"The operator's central marketing claim is a purported 0-day exploit targeting Phantom, the dominant Solana ecosystem wallet. The listing alleges that this exploit bypasses Phantom's Lighthouse anti-spoofing integration and its Safeguard transaction simulation engine. Phantom introduced the Lighthouse Guard Instructions system — developed in partnership with Lighthouse Protocol and audited by OtterSec — to detect simulation spoofing attacks in which a transaction appears benign during wallet preview but executes a drain on-chain. If the claimed bypass is genuine, it would represent a critical regression in one of Phantom's core user-protection mechanisms. As of the date of this report, Phantom Technologies has not issued a public statement specifically addressing Sector Drainer's claims. In a separate, unrelated 2026 dispute, Phantom stated that a reported vulnerability did 'NOT make user funds vulnerable in any way,' though that statement did not concern Sector Drainer specifically. No independent security researcher has publicly validated or replicated the alleged Sector Drainer bypass as of August 2026. The claim is therefore unverified and should be treated as alleged marketing copy until confirmed by a credible third party.","heading":"Alleged Phantom Wallet 0-Day Bypass","severity":"critical","sources":[{"credibility":1,"name":"Anti-Spoofing Security With Lighthouse — Phantom Official Blog","type":"official","url":"https://phantom.com/learn/blog/anti-spoofing-security"},{"credibility":2,"name":"Phantom Defends Wallet Safety Amid Allegations of Vulnerability — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/phantom-defends-wallet-safety-amid-allegations-of-vulnerability-endangering-user-funds/"},{"credibility":2,"name":"Sector Drainer Advertised as Crypto Wallet Drainer-as-a-Service — Dark Web Informer","type":"news_article","url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"}]},{"content":"The Sector Drainer listing enumerates a range of alleged technical capabilities consistent with contemporary DaaS offerings but distinguished by its Solana focus. The service claims: support for 150+ wallet types including Phantom, MetaMask, Trust Wallet, and Rabby; wallet asset scanning in under 0.4 seconds with transaction confirmation in under 0.8 seconds; hidden drain functionality that allegedly evades Blockaid, SEAL, Scam Sniffer, Hashdit, and WalletGuard detection systems; fake token receiving via honeypot techniques to lure additional approvals; unique UI spoofing impersonating major wallets; gasless draining via off-chain EIP-712 Permit signatures that require no gas fee from the victim and produce no visible 'Send' transaction; 'Autowithdraw' logic that executes a drain on any victim deposit with no expiration; automatic profit-splitting (Autosplit) between operator and affiliate; 70+ pre-made high-conversion landing page templates; free hosting with DDoS protection; cloaking technology to hide phishing pages from search engine crawlers and security researchers; and 24/7 support via Telegram and private messages. The claimed 95%+ wallet-connect UI/UX conversion rate and the sub-0.4-second wallet scan time are unverified marketing assertions.","heading":"Claimed Technical Capabilities","severity":"critical","sources":[{"credibility":3,"name":"Sector Drainer Forum Post — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.27046/"},{"credibility":3,"name":"Sector Drainer Forum Post — carder.market","type":"community_report","url":"https://carder.market/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.181982/"},{"credibility":2,"name":"Sector Drainer Crypto-Theft Kit Emerging on Dark Web Forums — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-alert-sector-drainer-crypto-theft-kit-emerging-on-dark-web-forums/"}]},{"content":"Sector Drainer operates under the standard DaaS affiliate model. The operator provides the draining infrastructure and phishing kit; affiliates are responsible for driving victim traffic through phishing campaigns, social engineering, Discord or X account compromises, and other distribution methods. The operator claims the service has been running since 2024 with hundreds of affiliate partners and over $4 million in cumulative team profits. The revenue-sharing structure is described in general terms as an 80/20 split in favor of affiliates, with a path to 90/10 after affiliates generate $5,000–$10,000 in stolen funds, though the listing presents these as example figures rather than fixed terms. No minimum deposit was listed as required for entry. These claims — particularly the $4 million profit figure and the number of affiliates — are unverified and originate solely from the operator's own advertising copy. The SentinelOne analysis of the broader DaaS ecosystem notes that operator cuts typically range from 5% to 25%, and that Angel Drainer required affiliates to post initial deposits of $5,000–$10,000, providing industry context for evaluating Sector Drainer's terms.","heading":"Business Model and Revenue Claims","severity":"high","sources":[{"credibility":2,"name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/"},{"credibility":3,"name":"Sector Drainer Forum Post — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.27046/"},{"credibility":2,"name":"Sector Drainer Advertised as Crypto Wallet Drainer-as-a-Service — Dark Web Informer","type":"news_article","url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"}]},{"content":"Sector Drainer recruits affiliates via Telegram, with a bot handle of @sectorlinksbot listed in the original forum advertisement, as well as via X (formerly Twitter) and Discord. The listing promises free hosting with DDoS protection for phishing pages and cloaking technology to evade security crawlers. This infrastructure model is consistent with other observed DaaS platforms. The Brinztech alert notes that Sector Drainer employs sophisticated social engineering tactics distributed through Telegram, X, and Discord platforms. The service includes 70+ pre-made phishing landing pages designed to impersonate legitimate projects with a claimed 95%+ wallet-connect conversion rate. No independent verification of hosted phishing infrastructure attributed to Sector Drainer has been publicly confirmed by a security firm as of August 2026.","heading":"Distribution Channels and Infrastructure","severity":"high","sources":[{"credibility":2,"name":"Sector Drainer Crypto-Theft Kit Emerging on Dark Web Forums — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-alert-sector-drainer-crypto-theft-kit-emerging-on-dark-web-forums/"},{"credibility":3,"name":"Sector Drainer Forum Post — carder.market","type":"community_report","url":"https://carder.market/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.181982/"}]},{"content":"Sector Drainer enters a well-established criminal ecosystem. Inferno Drainer operated from late 2022 until November 2023, when it announced shutdown after an estimated $80 million in thefts; it subsequently transferred operations to Angel Drainer. Pink Drainer wound down in 2024. Quark Drainer, which claims 480+ wallet support across 90+ chains, remains an active competitor. According to Scam Sniffer data cited by multiple security sources, wallet drainers collectively stole approximately $295 million from 324,000 victims in 2023 and $494 million from 332,000 victims in 2024, before declining to roughly $84 million in 2025. Sector Drainer's emergence in March 2026 follows the pattern of new entrants filling market share vacated by drainer shutdowns. SentinelOne's DaaS analysis notes that these platforms function as criminal SaaS businesses complete with developer tiers, affiliate recruitment, and technical support. Blockaid, which monitors malicious dApp activity, detected 20 coordinated X accounts sharing 75 different malicious dApps between September 2025 and January 2026 in campaigns associated with the Angel/Inferno lineage, illustrating the distribution scale these services can reach.","heading":"Context: DaaS Ecosystem and Predecessor Drainers","severity":"high","sources":[{"credibility":2,"name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/"},{"credibility":2,"name":"How Crypto Drainers Are Using X (Twitter) to Target Web3 Users — Blockaid","type":"research","url":"https://www.blockaid.io/blog/how-crypto-drainers-are-using-x-twitter-to-target-web3-users"},{"credibility":2,"name":"Return of the Crypto Inferno Drainer — Check Point Research","type":"research","url":"https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/"},{"credibility":2,"name":"Inferno Drainer Scam: Crypto Wallet Draining Malware Explained — Group-IB","type":"research","url":"https://www.group-ib.com/blog/inferno-drainer/"},{"credibility":2,"name":"Crypto Drainers as a Service: What You Need to Know — Cointelegraph / TradingView","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:366477b90094b:0-crypto-drainers-as-a-service-what-you-need-to-know/"}]},{"content":"SectorD's forum profile was new as of March 2026 with zero reputation points, a single post, and a single thread. This is a recognized pattern for DaaS operators who either create fresh aliases to avoid prior association or are genuinely new to underground marketplaces. The operator's claim that the service has been running since 2024 with hundreds of affiliates and over $4 million in profits is inconsistent with a zero-reputation forum profile, unless the team previously operated under a different name or recruited exclusively via Telegram. No corroborating evidence from on-chain analytics firms, major crypto security researchers, or law enforcement has been identified that independently attributes confirmed thefts to Sector Drainer or the SectorD alias. The claimed $4 million profit figure and 'hundreds of affiliate partners' must therefore be treated as low-confidence, unverified advertising claims sourced entirely from the operator's own listing.","heading":"Threat Actor Credibility Assessment","severity":"medium","sources":[{"credibility":2,"name":"Sector Drainer Advertised as Crypto Wallet Drainer-as-a-Service — Dark Web Informer","type":"news_article","url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"credibility":2,"name":"How Threat Actors Build Trust on Dark Web Hacking Forums — SL Cyber","type":"research","url":"https://slcyber.io/dynamics-on-hacking-forums-how-do-threat-actors-trust-each-other/"}]},{"content":"As of August 2026, no law enforcement action, indictment, asset seizure, or regulatory filing has been publicly attributed to Sector Drainer or the SectorD operator. No OFAC designation, SEC investigation, or DOJ action has been identified in available public records. For comparison, law enforcement has taken action against related DaaS infrastructure: Europol dismantled the Tycoon 2FA phishing-as-a-service platform in March 2026 following an operation linked to over 64,000 attacks, and Operation AudiA6 resulted in a multi-jurisdictional node disruption in June 2026. Sector Drainer has not been named in connection with these or other known enforcement actions.","heading":"Regulatory and Law Enforcement Status","severity":"medium","sources":[{"credibility":2,"name":"Europol Dismantles Tycoon 2FA Phishing-as-a-Service Platform — Rescana","type":"news_article","url":"https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform"},{"credibility":2,"name":"Joint Takedown of AudiA6 and Dark2Web — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-sovereign-law-enforcement-action-briefing-multi-jurisdictional-node-dismantling-industrial-money-mule-networks-and-core-blockchain-layer-traceability-the-joint-takedown-of-audia"}]},{"content":"Phantom's Lighthouse Guard Instructions, developed with Lighthouse Protocol and audited by OtterSec under a Solana Foundation grant, are designed to detect simulation spoofing by asserting that transaction preview state changes match actual on-chain outcomes. Blockaid's transaction simulation layer, Scam Sniffer's phishing detection, SEAL's response coordination, and WalletGuard's domain screening collectively form the current defensive stack targeted by Sector Drainer's alleged bypass claims. Users can reduce exposure by: verifying domain authenticity before connecting a wallet; reviewing transaction simulations critically and rejecting any that flag warnings; avoiding wallet connections initiated through Telegram, Discord, or X in-app browsers where cloaking may prevent security tool detection; revoking unnecessary token approvals regularly using tools such as Revoke.cash; and considering hardware wallet use for high-value holdings. The Cointrenches Solana security guide provides additional chain-specific guidance.","heading":"User Protection and Defensive Recommendations","severity":"medium","sources":[{"credibility":1,"name":"Anti-Spoofing Security With Lighthouse — Phantom Official Blog","type":"official","url":"https://phantom.com/learn/blog/anti-spoofing-security"},{"credibility":2,"name":"Best Solana Security Guide 2026: Protect Your Wallet from Drainers — Cointrenches","type":"news_article","url":"https://cointrenches.io/solana-security-guide-2026/"},{"credibility":2,"name":"Crypto Wallet Drainers Knowledge Hub — Group-IB","type":"research","url":"https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/"}]}],"sources_used":[{"credibility":2,"name":"Sector Drainer Advertised as Crypto Wallet Drainer-as-a-Service With 0-Day Phantom Bypass — Dark Web Informer","type":"news_article","url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"credibility":2,"name":"Sector Drainer Crypto-Theft Kit Emerging on Dark Web Forums — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-alert-sector-drainer-crypto-theft-kit-emerging-on-dark-web-forums/"},{"credibility":3,"name":"Sector Drainer Forum Post — carder.market","type":"community_report","url":"https://carder.market/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.181982/"},{"credibility":3,"name":"Sector Drainer Forum Post — crdworld.biz","type":"community_report","url":"https://www.crdworld.biz/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.27046/"},{"credibility":3,"name":"Sector Drainer Forum Post — hinull.com","type":"community_report","url":"https://hinull.com/threads/sector-drainer-%E2%80%93-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.8277/"},{"credibility":1,"name":"Anti-Spoofing Security With Lighthouse — Phantom Official Blog","type":"official","url":"https://phantom.com/learn/blog/anti-spoofing-security"},{"credibility":2,"name":"Phantom Defends Wallet Safety Amid Allegations of Vulnerability — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/phantom-defends-wallet-safety-amid-allegations-of-vulnerability-endangering-user-funds/"},{"credibility":2,"name":"The Rise of Drainer-as-a-Service — SentinelOne","type":"research","url":"https://www.sentinelone.com/blog/the-rise-of-drainer-as-a-service-understanding-daas/"},{"credibility":2,"name":"How Crypto Drainers Are Using X (Twitter) to Target Web3 Users — Blockaid","type":"research","url":"https://www.blockaid.io/blog/how-crypto-drainers-are-using-x-twitter-to-target-web3-users"},{"credibility":2,"name":"Return of the Crypto Inferno Drainer — Check Point Research","type":"research","url":"https://research.checkpoint.com/2025/inferno-drainer-reloaded-deep-dive-into-the-return-of-the-most-sophisticated-crypto-drainer/"},{"credibility":2,"name":"Inferno Drainer Scam: Crypto Wallet Draining Malware Explained — Group-IB","type":"research","url":"https://www.group-ib.com/blog/inferno-drainer/"},{"credibility":2,"name":"Crypto Wallet Drainers Knowledge Hub — Group-IB","type":"research","url":"https://www.group-ib.com/resources/knowledge-hub/crypto-wallet-drainers/"},{"credibility":2,"name":"Crypto Drainers as a Service: What You Need to Know — Cointelegraph / TradingView","type":"news_article","url":"https://www.tradingview.com/news/cointelegraph:366477b90094b:0-crypto-drainers-as-a-service-what-you-need-to-know/"},{"credibility":2,"name":"Drainer as a Service (DaaS) — Ledger Academy","type":"other","url":"https://www.ledger.com/academy/glossary/drainer-as-a-service-daas"},{"credibility":2,"name":"Europol Dismantles Tycoon 2FA Phishing-as-a-Service Platform — Rescana","type":"news_article","url":"https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform"},{"credibility":2,"name":"How Threat Actors Build Trust on Dark Web Hacking Forums — SL Cyber","type":"research","url":"https://slcyber.io/dynamics-on-hacking-forums-how-do-threat-actors-trust-each-other/"},{"credibility":2,"name":"Best Solana Security Guide 2026: Protect Your Wallet from Drainers — Cointrenches","type":"news_article","url":"https://cointrenches.io/solana-security-guide-2026/"},{"credibility":2,"name":"Anatomy of a Solana Wallet Drainer: Owner Reassignment, Durable Nonces, and Blinks Phishing — DEV Community","type":"research","url":"https://dev.to/ohmygod/anatomy-of-a-solana-wallet-drainer-owner-reassignment-durable-nonces-and-blinks-phishing-50a8"},{"credibility":2,"name":"Phishing and Wallet Drainer Incidents Statistics 2026 — CoinLaw","type":"research","url":"https://coinlaw.io/phishing-and-wallet-drainer-incidents-statistics/"},{"credibility":2,"name":"Joint Takedown of AudiA6 and Dark2Web — Brinztech","type":"news_article","url":"https://www.brinztech.com/breach-alerts/brinztech-sovereign-law-enforcement-action-briefing-multi-jurisdictional-node-dismantling-industrial-money-mule-networks-and-core-blockchain-layer-traceability-the-joint-takedown-of-audia"}],"summary":"Sector Drainer is a drainer-as-a-service (DaaS) toolkit that surfaced on underground cybercrime forums in March 2026, operated by a threat actor identified as SectorD. The service claims a 0-day bypass of Phantom wallet's Lighthouse and Safeguard protections, evasion of multiple major security services (Blockaid, SEAL, Scam Sniffer, WalletGuard), support for 150+ wallet types, and automated fund exfiltration infrastructure. No independent on-chain confirmation of the claimed $4 million in team profits or the validity of the 0-day has been publicly reported; the operator's forum account carried zero reputation at the time of listing.","timeline":[{"date":"2024-01-01","event":"Sector Drainer operator (SectorD) claims the service began operating, though this assertion is unverified and comes exclusively from the operator's own advertising copy.","source":"Operator self-report via forum listing — low confidence","source_url":"https://www.crdworld.biz/threads/sector-drainer-0-day-bypass-2026-hidden-drain-autowithdraw-free-hosting.27046/"},{"date":"2026-03-01","event":"SectorD registers on underground cybercrime forums (including crdworld.biz and carder.market) and posts the Sector Drainer DaaS advertisement listing a Phantom 0-day bypass, hidden drain, autowithdraw, and free hosting.","source":"Dark Web Informer; Brinztech","source_url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"date":"2026-03-04","event":"Europol-led coalition dismantles Tycoon 2FA phishing-as-a-service platform, reflecting broader law enforcement pressure on the phishing-as-a-service and DaaS ecosystem during the same period Sector Drainer surfaced.","source":"Rescana / Europol","source_url":"https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform"},{"date":"2026-03-18","event":"Dark Web Informer publishes the first indexed public report on Sector Drainer, followed by a Brinztech breach alert the same day.","source":"Dark Web Informer; Brinztech","source_url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"date":"2026-03-21","event":"Dark Web Informer article last modified, indicating continued monitoring or updates to the Sector Drainer report.","source":"Dark Web Informer page metadata","source_url":"https://darkwebinformer.com/sector-drainer-advertised-as-crypto-wallet-drainer-as-a-service-with-0-day-phantom-bypass-hidden-drain-and-autowithdraw-capabilities/"},{"date":"2026-08-04","event":"As of this date, no law enforcement action, OFAC designation, or independent on-chain confirmation of Sector Drainer attributed thefts has been identified in publicly available sources.","source":"AVOID.NET research compilation","source_url":"https://www.avoid.net"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 381a9e74-a90e-485a-b097-9e904fc15372copy