Crypto drainers as a service: What you need to know

Crypto drainers are malicious scripts stealing cryptocurrency by tricking users into connecting their wallets and authorizing unauthorized transactions. Unlike phishing for login credentials, drainers exploit wallet connections to directly access funds. Often disguised as legitimate Web3 projects, they are spread through compromised social media or Discord. Once connected, assets are instantly transferred. Drainers manifest as malicious smart contracts, fake NFTs, or deceptive token systems.

The threat is amplified by Crypto Drainers-as-a-Service (DaaS), a commercialized malware model. Similar to SaaS, DaaS platforms sell ready-made kits to cybercriminals, often taking a percentage of stolen funds. These kits include draining scripts, phishing kits, and support, attracting even low-skill scammers. DaaS tools include JavaScript-based drainers, token approval malware, clipboard hijackers, info-stealers, and modular kits employing obfuscation techniques. In 2023, drainers siphoned over $295 million in NFTs and tokens.

DaaS kits offer pre-built software, phishing templates, social engineering support, OPSEC tools, integration assistance, regular updates, user-friendly dashboards, documentation, and customer support. Accessible for $100-$500 or via subscription, these kits democratize sophisticated crypto attacks. Advanced DaaS tools constantly update to evade detection.

The evolution of crypto drainers shows a rapid rise since 2021, with drainers targeting MetaMask emerging prominently. Examples include Chick Drainer (targeting Solana), Rainbow Drainer, Angel Drainer (promoted on Telegram), and Rugging’s Drainer. Dark web discussions on crypto drainers surged by 135% in 2024, highlighting the growing threat. Their growth rate surpasses even ransomware.

Identifying attacks requires vigilance. Red flags include unauthorized transactions (including small, repeated transfers), lost wallet access, security alerts from wallet providers, fake project websites or DApps, unverified social media promotions, unaudited smart contracts, and wallet prompts requesting broad permissions.

Protection involves using hardware wallets, enabling 2FA, avoiding phishing links, securing private keys and seed phrases, verifying apps and browser extensions, and regularly monitoring wallet activity. If compromised, secure accounts, transfer remaining funds, notify providers, report to authorities, and seek professional assistance. While full recovery is unlikely, swift action minimizes losses.