Inferno Drainer

Overview

Inferno Drainer was one of the most prolific "drainer-as-a-service" (DaaS) operations. Its developers provided phishing kits, malicious scripts, and smart contracts to affiliates ("customers"), who set up fake Web3 sites — airdrops, mints, token claims, "wallet verifications" — to trick users into signing transactions or unlimited token approvals that drained their wallets. The developers took roughly 20% of stolen funds; affiliates kept ~80%, managing campaigns via a Telegram bot and web panel. ^[1][2]

How it works

Affiliates lured victims (often via hijacked or impersonated X/Discord accounts and ads) to phishing pages that spoofed real protocols such as Seaport, WalletConnect, and Coinbase. Once a wallet connected, the drainer identified the most valuable, easily transferable assets and crafted the malicious approval/transfer; assets under ~$100 were typically ignored. ^[1]

Scale and resurgence

Group-IB linked Inferno to 16,000+ phishing domains impersonating 100+ crypto brands; per Scam Sniffer figures it stole on the order of $80 million from about 137,000 victims between November 2022 and November 2023. The operators announced a shutdown in late 2023, but Check Point later reported Inferno had resumed, draining further millions using harder-to-detect single-use contracts and on-chain encrypted configs. It is frequently cited as the single largest contributor to drainer losses. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.