Edit: Inferno Drainer — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

## Overview

Inferno Drainer was one of the most prolific "drainer-as-a-service" (DaaS) operations. Its developers provided phishing kits, malicious scripts, and smart contracts to affiliates ("customers"), who set up fake Web3 sites — airdrops, mints, token claims, "wallet verifications" — to trick users into signing transactions or unlimited token approvals that drained their wallets. The developers took roughly 20% of stolen funds; affiliates kept ~80%, managing campaigns via a Telegram bot and web panel. [1][2]

## How it works

Affiliates lured victims (often via hijacked or impersonated X/Discord accounts and ads) to phishing pages that spoofed real protocols such as Seaport, WalletConnect, and Coinbase. Once a wallet connected, the drainer identified the most valuable, easily transferable assets and crafted the malicious approval/transfer; assets under ~$100 were typically ignored. [1]

## Scale and resurgence

Group-IB linked Inferno to 16,000+ phishing domains impersonating 100+ crypto brands; per Scam Sniffer figures it stole on the order of $80 million from about 137,000 victims between November 2022 and November 2023. The operators announced a shutdown in late 2023, but Check Point later reported Inferno had resumed, draining further millions using harder-to-detect single-use contracts and on-chain encrypted configs. It is frequently cited as the single largest contributor to drainer losses. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit