← Vanilla Drainer (DaaS)reviewed 2026-10-16 · 23 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Vanilla Drainer (DaaS) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #13[disputed][awaiting moderator]in section: Documented Thefts and On-Chain Tracing
“In July 2025, Darkbit linked Vanilla Drainer to an additional $2.19 million in losses, representing over 30% of all phishing losses for that month.”
reviewerIn July 2025, Darkbit linked Vanilla Drainer to an additional $2.19 million in losses, representing over 30% of all phishing losses for that monthNeither cited source contains the $2.19 million or 'over 30%' figures; the only July-specific numbers in the sourcing are $7.09M total and a $1.23M single theft (~17%, not >30%). This appears to be a fabricated or conflated statistic.Proposed correction (not yet applied)In July 2025, Scam Sniffer data showed $7.09 million in total phishing losses, a 153% increase from June, and Darkbit linked at least one $1.23 million theft that month to Vanilla Drainer-related wallets. - #21[disputed][awaiting moderator]in the timeline
“Darkbit links Vanilla Drainer to $2.19 million in July 2025 losses, comprising over 30% of the month's total phishing losses.”
reviewerTimeline: Darkbit links Vanilla Drainer to $2.19 million in July 2025 losses, comprising over 30% of the month's total phishing lossesSame underlying fabricated/conflated figure as in sections[4].content; grouped under the same defect_group.Proposed correction (not yet applied)Darkbit links Vanilla Drainer to a $1.23 million theft in July 2025, part of $7.09 million in total phishing losses that month according to Scam Sniffer data, a 153% increase from June.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in the summary
“No operators have been publicly identified and no law enforcement actions against the service have been confirmed as of mid-2026.”
reviewerNo operators publicly identified and no law enforcement action as of mid-2026Extensive searching found no reports of arrests or regulatory action, consistent with the claim, but a negative cannot be fully confirmed.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: Overview and Origin
“The service positions itself as a successor competitor to Inferno Drainer and Angel Drainer, which dominated the 2024 phishing market with combined industry losses near $500 million.”
reviewerVanilla Drainer positions itself as a successor/competitor to Inferno Drainer and Angel Drainer, which together with the 2024 market caused ~$500M in lossesNo source actually states Vanilla Drainer 'positions itself' this way; this is the page's own framing stretching an observation about customer migration into a self-description, and conflates an industry-wide loss figure with two named services. - #9[partially supported][awaiting moderator]in section: Technical Methods and Detection Evasion
“Combined payload sizes exceeded 2.7 MB across observed samples, with scripts served from Arweave-based decentralized storage (uploader.irys.xyz), making takedowns of the payload hosts more difficult.”
reviewerSEAL found Function() constructor runtime code construction, LZ-compressed base64 strings; combined payload >2.7MB served via Arweave-based irys.xyz storageCore technical claim (size, Arweave/irys.xyz hosting) is confirmed; the specific subdomain cited could not be independently verified.
confirmed
18 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Vanilla Drainer is a Drainer-as-a-Service (DaaS) criminal platform first documented in October 2024 that provides phishing kits and malicious smart contract infrastructure to affiliate fraudsters in exchange for a 15-20% commission on stolen proceeds.”
reviewerVanilla Drainer is a DaaS platform first documented in October 2024, providing phishing kits/malicious contracts for a 15-20% commissionMatches the primary cited reporting closely. - #2[confirmed][no action needed]in the summary
“Blockchain investigator Darkbit attributed at least $5.27 million in cryptocurrency thefts to the service within a three-week window in mid-2025, and the Security Alliance (SEAL) identified Vanilla Drainer as one of the two primary drainer families deployed via Google Ads malvertising campaigns that stole more than $1.27 million between March 13-30, 2026.”
reviewerDarkbit attributed $5.27M in thefts in a three-week window in mid-2025; SEAL tied Vanilla and Inferno to $1.27M+ in March 13-30 2026 Google Ads lossesBoth the Darkbit figure and the SEAL figure check out against primary sources. - #4[confirmed][no action needed]in section: Overview and Origin
“The earliest thefts attributed to the platform date to October 2024, while its first publicly known advertisement appeared on December 8, 2024, on underground forums.”
reviewerEarliest thefts date to October 2024; first known advertisement appeared December 8, 2024, claiming a Blockaid bypass via an 'advanced algorithm'Direct match to cited source. - #6[confirmed][no action needed]in section: Overview and Origin
“Blockchain investigator Darkbit stated that Vanilla was taking over many Inferno customers and that most of the large six- and seven-figure drains of the mid-2025 period could be attributed to Vanilla Drainer.”
reviewerDarkbit says Vanilla was taking over many Inferno customers and is linked to most large mid-2025 drainsConfirmed. - #7[confirmed][no action needed]in section: Affiliate Business Model and Commission Structure
“The platform retains 15-20% of all proceeds stolen by affiliates, with the commission rate reportedly declining for larger individual thefts.”
reviewerPlatform retains 15-20% commission, declining for larger theftsMatches cited reporting. - #8[confirmed][no action needed]in section: Affiliate Business Model and Commission Structure
“In the largest documented incident, a victim lost $3.09 million in stablecoins on August 5, 2025, and Vanilla's operators received an estimated $463,000 fee, representing approximately 17% of the stolen amount.”
reviewerLargest documented incident: $3.09M stablecoin theft Aug 5 2025, ~$463,000 (approx. 17%) operator feePage accurately reflects its cited source; the ~17% figure appears to be an approximation carried over from the original article. - #10[confirmed][no action needed]in section: Technical Methods and Detection Evasion
“Third, SEAL's analysis of samples from the March 2026 Google Ads campaign found that Vanilla Drainer payloads use runtime code construction via the JavaScript Function() constructor, with the drainer's core logic stored as LZ-compressed, base64-encoded strings that decompress only at execution time.”
reviewerFunction()-constructor runtime code build and LZ-compressed base64 strings used by Vanilla Drainer payloads per SEALConfirmed directly against primary source. - #11[confirmed][no action needed]in section: Google Ads Malvertising Campaigns (March 2026)
“Uniswap was the most impersonated protocol, accounting for 41% of the 352+ phishing URLs detected, followed by Morpho Finance at 31%.”
reviewerUniswap most impersonated (41% of 352+ URLs), Morpho Finance second (31%), SEAL blocked 356+ malicious URLs, March 13-30 2026Confirmed. - #12[confirmed][no action needed]in section: Google Ads Malvertising Campaigns (March 2026)
“Documented losses over the March 13-30 window totaled $810,929 from directly attributed phishing URLs, rising to $1,274,259 when including unattributed victim-reported transactions. Notable individual losses in this campaign included thefts of $385,000, $235,000, $179,000, and $69,000.”
reviewerDocumented losses $810,929 directly attributed, rising to $1,274,259 with unattributed reports; notable losses of $385,000/$235,000/$179,000/$69,000Confirmed. - #14[confirmed][no action needed]in section: Documented Thefts and On-Chain Tracing
“An earlier documented incident involved a victim losing $1.23 million.”
reviewerAn earlier documented incident involved a victim losing $1.23 millionConfirmed, though this is the same incident referenced by the disputed $2.19M/30% sentence immediately preceding it, which muddies the two into appearing to be separate, additive events. - #15[confirmed][no action needed]in section: Documented Thefts and On-Chain Tracing
“Stolen tokens are converted to Ether (ETH) or Dai (DAI) before being funneled to a fee wallet identified by Darkbit as address 0x9d3...E710d, which held approximately $2.23 million at the time of the analysis, primarily in DAI and ETH.”
reviewerFee wallet 0x9d3...E710d held approximately $2.23 million, primarily DAI and ETH; DAI preferred over USDT/USDC for freeze resistanceConfirmed via the primary cited article; the X/Darkbit thread itself could not be directly fetched (platform restriction) but is corroborated by secondary reporting. - #16[confirmed][no action needed]in section: Competitive Positioning in the DaaS Ecosystem
“Vanilla Drainer entered the market following the announced closure of Inferno Drainer in November 2023 and the subsequent handover of Inferno's tooling to Angel Drainer in late 2024. Despite those announcements, Inferno-linked activity persisted into 2025 and was tied to more than $9 million in losses over a six-month period, illustrating the difficulty of clean attribution when infrastructure transfers hands.”
reviewerInferno closed Nov 2023, handed tooling to Angel Drainer late 2024; Inferno-linked activity persisted into 2025 tied to $9M+ in losses over six monthsConfirmed via independent corroboration (Check Point Research, Cryptorank). - #17[confirmed][no action needed]in section: Competitive Positioning in the DaaS Ecosystem
“The broader DaaS ecosystem stole an estimated $500 million in 2024; 2025 saw a significant decline to approximately $83.85 million across 106,106 victims according to Scam Sniffer data cited in SlowMist's 2025 annual blockchain security report, representing an 83% drop in losses and 68% drop in victim count year-over-year.”
reviewerDaaS ecosystem stole ~$500M in 2024; 2025 declined to ~$83.85M across 106,106 victims (83% drop in losses, 68% drop in victims) per Scam Sniffer/SlowMistDirect fetch of the cited Medium URL returned HTTP 403 (likely anti-bot protection), but the identical figures were independently confirmed via SlowMist's own KYT blog mirror of the same report and secondary news coverage of Scam Sniffer's 2025 annual figures. - #18[confirmed][no action needed]in section: Competitive Positioning in the DaaS Ecosystem
“SEAL's October 2025 State of Drainers Vol. 1 report listed Vanilla Drainer among the four families under active monitoring, alongside Inferno, Rublevka, and Eleven Drainer.”
reviewerSEAL's October 2025 'State of Drainers Vol. 1' listed Vanilla Drainer among four actively monitored families alongside Inferno, Rublevka, Eleven DrainerConfirmed, though Vanilla Drainer receives lighter treatment (intro/summary mentions only) than the three families with dedicated sections — a minor nuance not reflected in the page's phrasing. - #19[confirmed][no action needed]in section: Regulatory and Law Enforcement Status
“As of mid-2026, no law enforcement arrests, indictments, or seizures specifically targeting Vanilla Drainer or its operators have been publicly reported. No regulatory actions by the SEC, CFTC, DOJ, Europol, or equivalent agencies have been filed against the service. SEAL's Ethereum Foundation-funded anti-drainer program, announced in February 2026, monitors the service and blocks malicious advertisement URLs, but operates as a civil detection and takedown effort rather than a law enforcement action.”
reviewerNo law enforcement arrests/indictments/seizures or regulatory actions (SEC/CFTC/DOJ/Europol) against Vanilla Drainer publicly reported as of mid-2026; SEAL's EF-funded program announced Feb 2026 is civil, not law enforcementConfirmed; extensive searching found no reports of any law enforcement or regulatory action against Vanilla Drainer. - #20[confirmed][no action needed]in section: Investigative Confidence and Source Limitations
“While Darkbit's on-chain methodology is described as address-tracing of fee wallet flows, no independent peer-reviewed verification of the $5.27 million figure or the fee wallet address (0x9d3...E710d) has been published by a separate Tier 1 or Tier 2 source.”
reviewerNo independent peer-reviewed verification of the $5.27M figure or fee wallet address has been published by a separate Tier 1/2 source; coverage is largely derivative of Darkbit/CoinTelegraphThis self-assessment by the page is accurate: all located coverage is derivative of the single Darkbit/CoinTelegraph source chain. - #22[confirmed][no action needed]in the timeline
“Security Alliance (SEAL) publishes 'State of Drainers Vol. 1,' naming Vanilla Drainer among four actively monitored drainer families alongside Inferno, Rublevka, and Eleven.”
reviewerTimeline: SEAL publishes 'State of Drainers Vol. 1' on 2025-10-07, naming Vanilla Drainer among four monitored familiesDate and content confirmed. - #23[confirmed][no action needed]in the timeline
“SEAL's documented March 13-30 campaign window closes with $810,929 in directly attributed losses and $1,274,259 in total including victim-reported incidents. SEAL has blocked 356+ malicious ad URLs.”
reviewerTimeline: SEAL campaign window March 13-30, 2026 closes with $810,929 directly attributed losses, $1,274,259 total, 356+ blocked URLsConfirmed.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.