Welcome back, aspiring investigators! 

Let’s talk about something that has become one of the biggest problems in the crypto world. It’s drainers. If you haven’t heard the word before, don’t worry, you’re about to become very familiar with it. Drainers are a type of phishing attack, and they have swept through the cryptocurrency world at a truly striking pace. In fact, they are now growing so fast that they have already overtaken ransomware, both in how widespread they are and in the sheer amount of money they steal. To understand exactly how this works, we dug into the mechanics of drainers as well as the whole shadowy little market that has grown up around them. That’s what we are going to explore together today.

The basic idea behind any phishing campaign is to catch you making a mistake. Hackers want you to hand over information or access that should never leave your hands. In the specific case of drainers, the goal is a little different from classic phishing. The hacker wants to trick you into granting a smart contract permission to interact with your funds. Once you give that permission, the damage is already done. Drainers mostly go after blockchains that support smart contracts. That means they target users on Ethereum and Ethereum-like networks, such as Base, Polygon, and Optimism. But don’t think Ethereum is the only battlefield. Drainers built for Solana exist too, and a drainer aimed at Bitcoin has already made an appearance.

Imagine you want to connect your MetaMask wallet to some project’s website because you’re hoping to grab a little free crypto. Maybe you want to buy a brand-new token while it’s still cheap, before the price shoots up. You click Connect, you type in your password, and you sign a transaction that approves access to your wallet. And that, right there, is exactly the moment a drainer catches you. Instead of a legitimate contract that would let you receive tokens, the hacker gets you to sign a malicious smart contract. In doing so, you unknowingly grant permission for your funds to be transferred out. In effect, you agree, with your own hand, to give away all your money.

So how does a hacker actually pull this off? It works best with something called an airdrop, which is simply a giveaway of new tokens. Airdrops attract a swarm of people who are hoping to get a little bit of crypto that might grow tens of times in value down the road. These giveaways do genuinely happen sometimes, as a real way to promote a new token. So people have learned to trust them. In that exact moment, the user is driven by something we call FOMO, the fear of missing out on a gain.

In their rush to grab the airdrop, a person often doesn’t stop to check who actually created the page they are interacting with, or what the smart contract they are approving actually does under the hood. The website itself might be a perfect copy of the real one, built by the hacker down to the smallest detail, while the smart contract underneath does the opposite of what it promises. Instead of giving you money, it takes it.

Drainers Are Gaining Momentum

In 2024, drainers overtook ordinary ransomware, both in how far they spread and in how much money they brought in. Now, don’t get it wrong, ransomware is still very much the scourge of large businesses. But scammers, being the opportunists they are, have rushed into this new and still relatively uncrowded niche. The very first drainers spread quietly, as scripts traded on darknet marketplaces. Back in 2022 there were 55 unique forums where you could find drainers being sold or discussed. By 2024, that number had jumped to 129 such places, more than double in just two years.

And keep in mind, that count only covers a place as niche and honestly as sparse as the dark web. Most of the real action these days happens on Telegram and Discord.

The biggest drainers active in 2024 had names like Angel, Inferno, Ping, Ace, Cerberus, Nova, Medusa, MS, CryptoGrab, and Venom. Of that whole list, mainly Angel and Ace are still active today, but a new player has stepped onto the stage, one called Vanilla. It hasn’t been studied very closely yet, because it runs on a private model that is difficult for the average scammer to even get access to.

According to Scam Sniffer, a company that closely analyzes different types of crypto fraud, total losses from drainers in 2024 added up to $494.000.000.

That figure only counts the large-scale hacks that could actually be tallied and confirmed. Since drainers mostly target ordinary, everyday users, small thefts of just a few thousand dollars here and there don’t even make it into that statistic. So the real number is almost certainly much higher. 

Among the large-scale cases recorded in 2024, there were more than three hundred thirty thousand victims. The single biggest theft that year came to $55.000.000. All together, there were roughly thirty major fraudulent campaigns, which is one and a half times more than the year before, in 2023. In the first quarter of 2024 alone, drainers showed almost sixfold growth. Compare that to ransomware, which only doubled over that same stretch of time.

So what do all these numbers really mean? Well, because the barrier to entry into this line of work is so remarkably low, it has started attracting scammers who used to work in more old-fashioned territory, like email phishing, luring victims to fake bank login pages and other traditional scam types. A couple of months of this kind of work could buy an apartment, a car, and regular vacations somewhere warm like Thailand. Take one risk, and you can just walk away, or so the thinking goes. But of course, once someone gets a real taste of easy money like that, nobody actually walks away after two months. The business pulls them back in.

Think about the contrast here. A ransomware group has to negotiate with a company, arrange for payment, and handle the whole business of decryption afterward. That’s a lot of hassle and a lot of steps where things can go wrong. A drainer, on the other hand, just steals the money immediately. No negotiation needed. 

Like plenty of other kinds of scams out there, drainers are distributed under what’s called a SaaS model, short for Software-as-a-Service. In this criminal corner of the internet, they’re called DaaS, meaning Drainer-as-a-Service.

There’s also a very characteristic division of labor inside these operations. You’ve got developers, who build the actual malware. You’ve got workers, the rank-and-file operatives out doing the scamming day to day. And alongside them you’ve got recruiters, traffic-generation specialists, and providers of various supporting services that keep the whole machine running. The main job, naturally, falls to the developers. They are the ones who create the malicious software and work to make it more convenient to use, easier to deploy, and easier to scale up. 

How the “Company” Is Built

So what does a hacker actually need in order to pull off a phishing campaign like this?

First, they need domains for their future sites, and these domains are usually spelled just similarly enough to the name of the real project they’re impersonating, so a distracted eye won’t catch the difference. Then they need hosting, which is simply a place to put the site once it’s built. Naturally, they also need a landing page, one designed to closely resemble the legitimate project’s real page. Underneath that landing page sits the drainer code itself, which is typically JavaScript code hosted directly on the site. On top of all that, they’ll usually build a control panel that shows them how many users have been lured in and tracks how those users are behaving on the page. And finally, hackers take their own security seriously too, relying on VPNs, proxies, and fake sockpuppet accounts to cover their tracks.

Professional hackers usually go a step further and set up a full command-and-control server, which lets them manage the drainer’s behavior remotely and adjust it on the fly.

Once all of that infrastructure is in place, all that’s left is bringing in people, actual victims to walk through the trap. That job falls to traffic arbitrage specialists, sometimes called traffic drivers. Their whole task is to funnel users toward the phishing page. They accomplish this in all sorts of ways, everything from buying Google ads to jumping directly into comment sections and posts to engage with real users. Some scammers even go so far as to clone the official support channels of legitimate projects, so a victim reaching out for help ends up talking to the scammer instead.

Put it all together, and what you get is a genuine sales funnel, a designed path that walks victims toward the trap, just like any legitimate marketing funnel would walk a customer toward a purchase.

How the Money Is Split

Here’s how the profits typically get divided up. Operators, the people running the overall scheme, take home twenty to thirty percent of whatever gets stolen. The rest goes to the workers, the people directly out there scamming victims day to day. A worker’s exact cut depends on their skill level. Beginners give up thirty percent of their take to the operators, while the most experienced workers only give up ten to fifteen percent.

And how is a worker’s skill level judged? Simply by how much they have already managed to steal over time. If you’ve stolen up to $10.000 total, you’re considered a beginner. Between $25.000 and $30.000 puts you at mid-level. And starting from $100.000, usually climbing toward a million or more, you’re considered a true professional in this dark little trade.

Driving Traffic

Knowledge in this underground world gets passed around among workers through tutorials. A tutorial itself becomes an item that gets bought, sold, and traded, almost like a piece of merchandise. Entire communities have formed just to gain access to these tutorials, treating them like valuable trade secrets. The writing style of these tutorials makes it fairly clear that AI tools were used to help put them together.

Broadly speaking, the same traffic-driving scheme used in ordinary, everyday phishing applies here too, just adapted for the world of crypto. A worker is essentially doing the same job as any online advertising specialist would. Their goal is simply to increase the number of people clicking through to the phishing page. That means hunting for users who are genuinely interested in Web3 and DeFi projects, people who hold crypto wallets and who are drawn to airdrops, token swaps, and exchanges.

This whole process involves demographic analysis and geolocation analysis, essentially the same ordinary targeting techniques that any advertiser in any industry would recognize. Workers also handle what they call “site design,” which really just means cloning the pages of existing, trusted projects. They’ll even use classic marketing techniques like A/B testing to see which fake page tricks more people.

Now let’s walk through a few high-profile examples of drainer thefts.

The Attack on Arkham Intelligence

Arkham is a company that provides on-chain analytics, and it’s a genuinely popular tool for tracking transactions. Traders rely on it, for instance, to check an asset’s price and see exactly where it’s trading across different platforms.

Back in 2023, Arkham’s owners launched their own token along with an airdrop of coins to celebrate. But hackers saw an opportunity and created numerous fake profiles on X specifically to redirect users toward phishing pages containing a drainer. Remarkably, these bot accounts proved quite resilient and managed to avoid being banned for a long stretch of time. They mimicked Arkham’s real activity closely and spread malicious links far and wide.

A huge number of these fake sites were created during the campaign, and each one typically had a lifespan of just weeks, or a couple of months at most. Angel’s software allowed a hacker to copy landing pages quickly and place them on brand-new domains almost instantly. The whole process has been simplified so much that a worker only needs to type a few commands into a conversation with a Telegram bot in order to deploy an entirely new phishing site.

The Attack on the SEC

An even bigger impact can be achieved by a hacker hijacking the real, verified account of some authoritative company, or even a government organization.

And that’s what happened with the United States Securities and Exchange Commission, or the SEC. On January 9, 2024, its account on X was compromised through a technique called SIM swapping, which basically means reissuing a SIM card tied to the phone number linked to that account. Officials, unfortunately forgetting about basic security hygiene, hadn’t even enabled multi-factor authentication on the account.

Lately, the SIM-swapping community and the drainer community have grown noticeably closer, almost like two neighboring criminal industries starting to collaborate. Swappers now routinely supply drainers with freshly hijacked accounts to use.

The hackers behind this attack posted that the SEC had officially approved investing in Bitcoin without needing to buy crypto directly on an exchange like Binance or Coinbase. This caused an immediate stir, because investors had been waiting a long time for exactly this kind of decision from the SEC, and many expected it to be announced any day. Following the fake post, the hackers urged people to claim an “official SEC airdrop” on a special site that contained a drainer.

That single fake post even caused a real spike in Bitcoin’s price. It rose by a full thousand dollars, just from a fake tweet.

Scamming the Scammers

Scammers, as it turns out, wouldn’t really be scammers if they didn’t also scam each other. At one point, the developer behind the Pink Drainer felt like he was getting close to being unmasked, so he decided to get out of the game entirely and cash out his loot. Here’s the catch, though. You can’t just sell crypto obtained through a scam outright. To actually withdraw the funds, a scammer first has to launder the money, or else an exchange might get suspicious and freeze it before it ever reaches a real bank account.

To avoid enabling things like terrorism financing, or simply to stay within the law, exchanges use a system of scoring and refuse to accept “dirty” crypto. This scoring system is called an AML score, short for anti-money-laundering. There are plenty of laundering methods out there, and while trying one of them, Pink Drainer’s own developer ended up getting scammed himself.  He fell for one of the simplest kinds of fraud imaginable called address poisoning. 

Here’s how it works. Hackers generate crypto addresses that closely resemble a victim’s real address, and then they send that victim a tiny amount of crypto, just enough so that the lookalike address shows up in the victim’s transaction history.

From the user’s side, here’s what it looks like in practice. You send, say, one hundred dollars to some other wallet, maybe an exchange you use regularly. Then, five or ten minutes later, you receive a few tiny transfers that appear to come from that very same wallet. But in reality, they only come from a similar-looking address, one that might share, say, an identical start and end to the real address, while the middle is different.

The hacker is betting that on your next transfer, you’ll simply scroll through your history, pick the most recent address you see, and send your money not back to yourself, but straight into the hacker’s pocket. And that’s exactly how Pink Drainer got caught in his own kind of trap. He picked what looked like the last transaction in his history and sent ten ETH, worth about $15.000 at the time, straight to some unknown “colleague” who was never really his colleague at all.

Conclusion

Because draining is so easy and profitable, this type of scam is not going away anytime soon. If anything, the ways malicious payloads get delivered will only keep getting more sophisticated from here. Drainers are increasingly setting their sights on younger blockchains too. On Ethereum-based networks, it’s steadily getting harder for hackers to operate, since protective measures keep appearing that they have to find new ways to bypass. On Solana, though, no such protections really exist yet, which makes it a much softer target. New kinds of drainers will keep emerging as well. Some scammers have already started building actual apps for Google Play and the App Store, moving beyond simple websites and into places millions of people trust by default. So stay alert out there, and think twice before you click any button, especially one promising you free money. If it feels too good to be true, in crypto more than almost anywhere else, it usually is.

If you’re interested in cryptocurrency forensics, we have a dedicated training called Bitcoin and Cryptocurrency Forensics. You will get to dive into blockchain analysis and cryptocurrency investigations, learning the skills needed to become a cryptocurrency forensic analyst. You can buy the training separately or attend it live on September 15-17 at 3 PM UTC.

The post Cryptocurrency Drainers: How Hackers Steal Cryptocurrency first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Many of us are being pushed toward insecure messengers and social networks. These communication channels may be monitored and are not trustworthy. That does not mean private communication is impossible. Far from it. One of the oldest and most practical problems in cryptography is how to send a secret message through an open channel without making the message obvious to anyone who sees it. And that problem has already been solved very well.

The encrypted text does not always have to look like encrypted text. A message can be hidden in plain sight so that it looks like ordinary content, or it can be embedded inside something else entirely, such as audio, video, or text that does not raise suspicion. That is the realm of steganography. Cryptography protects the meaning. Steganography helps hide the fact that a message exists at all.

For most people, though, the real need is much simpler. They want a practical and convenient way to encrypt messages quickly and reliably. So let’s look at some easy tools that make that possible.

Workflow

The workflow is always the same. First, the sender and recipient agree on a secret password or passphrase. A short sentence made up of several words is often better than a single word because it is easier to remember and usually much stronger. Then the sender pastes the message into the tool, clicks Encrypt, enters the password, and sends the resulting encrypted text through whatever channel they want, even if that channel is insecure. The recipient then uses the same tool and the same password to decrypt the message.

That is the basic pattern, and it stays consistent across different tools and platforms.

Web-Based Encryption Tools

There are browser-based applications that can encrypt text very effectively, and they are often the easiest place to begin. But there is one very important detail. You want to make sure the encryption happens entirely on the client side. That means the message is processed inside your browser, on your own machine, and the password never leaves your device. If the server never sees the key, the risk of leakage is much lower.

That point is worth checking. A good looking website is not automatically secure. One way to verify local processing is to monitor browser traffic using Developer Tools, or DevTools, and see whether your password is being sent over the network. Another way is to use a firewall application such as Little Snitch and observe whether the service tries to communicate with remote servers during encryption or decryption. If the system is truly local, the encrypted message can later be decrypted either through the same browser-based Decrypt form or offline with OpenSSL.

There are a few websites out there. 

The first one is Encrypt Online. It uses AES-256-CBC to encrypt text, strings, JSON, YAML and config data directly in your browser. It’s considered to be a strong, mathematically unbreakable encryption algorithm.

Paranoia Text Encryption uses AES-256 in EAX mode with keys derived from passwords using Argon2. That combination is strong and modern.

LOCK.PUB is another browser-based option, focused on creating encrypted online notes, polls, images, audio and a lot more. The content can only be accessed with the correct password.

For users who want something more flexible and technical, GCHQ CyberChef is a powerful open-source option from the UK’s GCHQ intelligence agency. It supports many encryption and encoding operations. 

AES Utils is another choice, using AES-256-GCM with PBKDF2 while keeping the interface simple.

Warning

As a contrast, it is useful to look at what should not be considered a proper secure solution. MagicTool encrypts and decrypts text without requiring a password. 

At first glance that may sound convenient, but from a cryptographic point of view it means the same built-in secret is used every time. If anyone knows the website and the service’s behavior, they may be able to infer or recover the messages. In that setup, the tool itself is functioning like the secret key simply by existing.

That is not a strong cryptographic model. However, in some situations, “encryption” without a user-provided key could still serve a purpose. For example, it might be used to deceive an adversary into believing you are an inexperienced user who does not know how to encrypt messages properly, when your real objective is to feed them specific information in a controlled manner.

Offline Encryption Software

Browser tools are convenient, but sometimes you want something local, traditional, and fully under your control. Linux, Windows, and macOS all have native or widely trusted applications that can encrypt text and files without relying on a remote browser service.

Common examples include command-line tools such as GnuPG, OpenSSL, and ccrypt, along with password managers, VeraCrypt, Cryptomator, and a wide range of similar utilities. These tools are often used not only for text messages but also for file encryption, container protection, and secure storage.

Offline tools have an advantage because they reduce the number of outside systems involved in the process. You are not dependent on a remote website staying available, and you do not need to trust a third-party server with your content or password. For many users, that is a better model from a privacy perspective. At the same time, it is important to understand that privacy tools still leave traces. On a Windows system, a digital forensics investigator may be able to see installation artifacts, program execution history, registry keys, recent files, shortcut files, jump lists, user activity traces, prefetch data and remnants of encrypted containers or text editors. Even when the content itself remains protected, the fact that you used a particular application may still be visible in the system’s history.

That is why privacy-conscious users often prefer systems that are designed to leave fewer traces by default. A privacy-oriented operating system, live environment, or hardened Linux distribution can be a better choice when your goal is to reduce unnecessary local exposure. 

Summary

Encrypting messages is a simple and useful privacy skill. Whether you use a browser-based tool or you prefer offline software the basic principle is the same. 

The right tool depends on the situation. Browser-based tools are convenient and fast. Offline tools give you more independence and more control. Some systems are designed for strong cryptography, while others are only suitable for demonstration or deceptive use. Understanding the difference matters.

If you want to go deeper into how privacy can be preserved on real systems and how forensic traces are created and analyzed, our Anti-Forensics training is your next step. We covered advanced techniques for preserving your privacy and understanding what investigators can still see even when you think you have covered your tracks.

The post Anti-Forensics: How to Encrypt Messages in Any Messenger or Social Network first appeared on Hackers Arise.