Timelock Account Recovery Gives Ethereum Smart Accounts A Safer Backup Route is a useful reminder that crypto coverage is not only about token prices. Sometimes the more important story is the infrastructure, regulation, security, or product layer sitting underneath the market noise.
The immediate point is straightforward: a new Ethereum Magicians proposal outlines timelock-based smart account recovery. That gives readers something concrete to work with, rather than another vague sentiment update.
TL;DR
A new Ethereum Magicians proposal outlines timelock-based smart account recovery.
The design aims to reduce trust in guardians by adding delay and cancellation windows.
The idea could make ERC-4337 wallets safer for ordinary users if it matures.
Why This Matters Now
The timing matters because Ethereum is already part of a wider conversation across the market. Traders want to know whether the development changes liquidity or risk. Builders want to know whether it changes what can be deployed. Compliance teams want to know whether it changes how platforms operate.
In that sense, the story is bigger than one headline. It sits inside the ongoing shift from speculative crypto cycles toward more practical questions: who can use these systems, how safe are they, and whether the underlying incentives actually work.
The best way to read it is with discipline. It is not a guarantee of immediate upside, and it should not be treated as one. But it does add a fresh data point to the way the market is thinking about Ethereum.
The Ethereum Angle
For Ethereum, the important part is the specific mechanism. If this is a security issue, the risk sits in dependencies and user protection. If it is a listing or product launch, the question is access and liquidity. If it is a governance or research proposal, the question is whether the idea can survive implementation.
That is where this update becomes useful. It is not just a label attached to a trend. It gives readers a way to understand what might actually change if the development gains traction.
Crypto has a habit of turning every announcement into a broad market claim. This one deserves a narrower read. The value is in seeing how it affects the users, developers, institutions, or traders closest to the issue.
The Risk Side
There is also a caution attached. Source material can confirm that a development exists, but it cannot prove that adoption will follow. A proposal still needs support. A product still needs users. A chart still needs confirmation. A compliance tool still needs integration.
That is why the responsible reading is not to oversell the story. The stronger takeaway is that this adds to a pattern. The crypto market is steadily becoming more professional, more technical, and more sensitive to real operational details.
Readers should also watch for follow-up signals. That could mean developer feedback, exchange support, regulatory response, wallet adoption, liquidity data, or simply whether market participants continue reacting after the first headline fades.
What Comes Next
The next stage will decide whether this remains a narrow update or becomes part of a larger market theme. In crypto, that difference matters. Plenty of stories look important for a few hours and then disappear. The ones that last usually show up again through usage, liquidity, enforcement, governance, or developer adoption.
For now, this gives the market another piece of information to weigh. It is specific enough to be useful, but still early enough that readers should keep the caveats in view.
That makes it worth covering without pretending it settles anything. The story is a signal, not a final verdict.
Solana’s growth story is often told through speed, fees, and developer momentum. Address growth adds another layer, but it needs to be read carefully. A higher wallet count can be encouraging, yet it does not automatically prove that a network has deeper economic activity.
That is the right way to look at the current Solana signal. The market wants to know whether user growth is sticky, whether dApps are retaining activity, and whether validators and applications are seeing enough demand to make the network’s momentum durable.
For more details, visit the official GitHub platform.
TL;DR
Solana address-growth data has returned to the discovery pack as a market signal.
The useful question is whether wallet growth translates into repeat users and real application demand.
The article should avoid overstating the GitHub proposal page as a direct on-chain dashboard.
Address Growth Is Only The First Question
New wallets can reflect real adoption, speculative farming, airdrop behaviour, or short-term campaign activity. That is why address counts are useful, but not complete. They need to be paired with fees, transactions, DEX activity, app usage, and retention.
For Solana, the positive case is that low fees and fast execution make it easier for users to keep coming back. The challenge is proving that those users are not just passing through.
What Would Make The Signal Stronger
The strongest confirmation would come from broader app-level data: more users on DeFi protocols, stronger NFT or gaming activity, sustained stablecoin transfers, and fee demand that does not disappear after incentives fade.
Until then, address growth is a constructive sign, not a finished thesis. Solana has the attention. The question is how much of that attention becomes durable network value.
Why The Detail Matters Now
The practical takeaway is that Solana stories now have to be read through both market structure and product execution. A headline can create attention, but the more durable signal is whether the underlying source points to real activity, a real filing, a real integration, or a measurable change in how users and institutions behave.
That is why this development is worth separating from ordinary market noise. It gives readers a specific point to track over the next few sessions rather than a vague reason to be bullish or bearish. If follow-up data confirms the direction, the story can build. If not, it still gives the market a clearer snapshot of where attention is concentrating today.
The Market Read
The cleaner way to read this story is not to force it into a simple bullish or bearish box. For Solana readers, the useful part is the change in context. A new filing, integration, market signal, or regulatory step can alter how traders think about the next few sessions even when it does not instantly change price.
That is especially true after the last few volatile weeks, when crypto has been dealing with a mix of ETF flows, legal updates, exchange listings, protocol upgrades, and shifting liquidity. The market is no longer reacting to one dominant theme. It is weighing several smaller signals at once, and that makes source-backed developments more important than ordinary chatter.
Why Readers Should Keep This On The Radar
For NewsBTC readers, the important question is what this changes from here. If follow-up data, filings, governance updates, or wallet movement confirm the direction, the story can develop into a larger market theme. If the next update is weak, delayed, or contradicted by new data, the market may quickly move on.
That is why the scope matters. This article is not treating the development as a guaranteed price trigger. It is treating it as a fresh signal inside a market that is trying to sort durable activity from short-term noise. The distinction is important because crypto narratives can move faster than the facts behind them.
The next thing to watch is whether this becomes part of a wider pattern. In some cases that means more institutional flows. In others it means stronger developer adoption, cleaner regulatory access, deeper exchange liquidity, or a clearer technical roadmap. Either way, the story is strongest if it is followed by measurable execution rather than another round of speculative headlines.
This article is based on Solana ecosystem materials and the source pack’s network-growth lead.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information from GitHub. at GitHub
The wallet race is no longer just about who supports the most chains. It is about who becomes the easiest front door for ordinary users. Bitget Wallet’s TON-related push sits right in that shift, especially as Telegram-linked ecosystems keep pulling crypto closer to messaging and social behaviour.
That matters because wallets are often the first real crypto product a user touches. If the wallet experience feels confusing, everything built on top of it suffers.
For more details, visit the official Chainwire platform.
TL;DR
Bitget Wallet is highlighting growth and TON-related wallet functionality.
The larger story is the race to make Web3 wallets feel usable inside everyday social ecosystems.
Gasless transfer features could lower friction for retail users who do not want to manage fees.
Why TON Is Interesting For Wallets
TON’s advantage is distribution. Its connection to Telegram-adjacent user behaviour gives wallet providers a chance to meet people where they already spend time rather than asking them to start from a blank crypto app.
If gasless transfers become practical, that distribution advantage becomes even stronger. Users do not want to understand gas tokens before sending value. They want the transaction to work.
The 100 Million User Claim
Bitget Wallet’s 100 million user milestone should be read as a growth claim, not proof of active daily usage. Still, the number points to how competitive the wallet layer has become.
Wallets are no longer passive storage tools. They are swap interfaces, dApp browsers, identity layers, payment tools, and onboarding funnels. That is why user growth in this category can matter.
What The Market Should Watch
The next test is retention. A wallet can gather users through campaigns, integrations, and new chain support. Keeping them active is harder. That requires useful applications, reliable execution, and a simple enough experience that people return.
For now, Bitget’s TON push reinforces the broader trend: crypto wallets are trying to become consumer products, not just key management tools.
The Story Beneath The Headline
The useful way to read this story is not as a standalone headline about Bitget Wallet, but as part of the wider pressure building around Crypto coverage this week. Markets have been jumping quickly from one catalyst to the next, so the cleaner value for readers is in separating the actual development from the instant reaction around it. In this case, the source material gives us a concrete event to work from, rather than a loose rumour or a recycled social-media talking point.
That distinction matters because crypto readers are being asked to process a lot at once: ETF flows, regulatory actions, exchange listings, protocol upgrades, wallet movements, and political signals. A story like this is most useful when it helps them understand where TON Network fits into that broader map. It does not need to be inflated into a guaranteed price call to be worth covering. It simply needs to explain what changed, who is affected, and why the market is paying attention today.
The caveat is also important. Even clean source-backed developments can be overinterpreted when traders are hunting for a fast narrative. A listing does not automatically create lasting demand, a regulatory update does not immediately settle every legal question, and an on-chain movement does not always translate into a finished sale. The better read is to treat the development as a fresh data point and then watch whether follow-up activity confirms the direction of travel.
For Bitcoinist readers, that means keeping the focus on what can actually be verified from the source and avoiding the temptation to turn every update into a sweeping market verdict. The story is strong enough on its own terms: it gives investors and traders another piece of context around Crypto, while leaving room for the next filing, dashboard update, wallet movement, governance vote, or exchange notice to decide whether the angle grows into something bigger.
This report is based on information from Chainwire.
This article was written by the News Desk and edited by Samuel Rae.
The German government wallet has been a bearish headline machine for Bitcoin. Now that the balance is reportedly down to less than 20% of the original seized stack, traders have a new question: what happens when this particular source of selling pressure is mostly gone?
The useful way to read this is not as a guaranteed price signal, but as a fresh piece of information in a market that is trying to sort real developments from noise. That does not mean Bitcoin automatically rallies once the wallet empties. Other pressures remain. But removing a visible seller can change market psychology, especially if ETF demand and spot buyers keep absorbing supply.
For more details, visit the official Arkham platform.
TL;DR
Germany-linked wallets now hold less than 20% of the seized BTC balance.
The drawdown suggests one of the market’s clearest supply overhangs may be nearing its end.
Traders are watching whether BTC stabilizes as this pressure fades.
Why the endgame matters
Markets can often handle bad news better when they can measure it. A visible wallet with a shrinking balance gives traders a rough sense of how much supply may still be left to process.
That does not mean Bitcoin automatically rallies once the wallet empties. Other pressures remain. But removing a visible seller can change market psychology, especially if ETF demand and spot buyers keep absorbing supply.
The Market Read
Make this more market-psychology focused than the NewsBTC version.
That is the balance readers need to keep in mind. Crypto markets are quick to turn every update into a single-direction trade, but most durable stories are more layered than that. They matter because they change positioning, incentives, infrastructure, or regulation over time.
What Comes Into Focus Now
From here, the important thing is follow-through. If the source data, company update, filing, or on-chain record continues to move in the same direction, this can become part of a larger trend. If it stalls, it is still useful as a snapshot of where attention is sitting today.
For traders and readers, the cleaner takeaway is to separate the confirmed development from the speculation around it. The confirmed part is what deserves coverage. The speculation is what needs caution.
For Bitcoin readers specifically, the story is useful because it gives a clearer frame for the next few sessions. It tells them what to watch, which part of the market is reacting, and where the first obvious risk sits. That is more valuable than simply saying a token, company, or regulator has made a move. The useful work is in connecting the update to liquidity, positioning, adoption, enforcement, or user behaviour without pretending that any single headline controls the whole market.
The practical question now is whether this remains an isolated update or becomes part of a chain of follow-through. A second filing, another wallet move, fresh dashboard data, a new governance vote, or a stronger market reaction can all turn a clean single-day story into a broader narrative. Without that follow-through, it still matters, but more as a marker of where attention was concentrated on July 8 than as a complete trend on its own.
That distinction is especially important in a market where headlines can travel faster than context. A source-backed update gives readers something firmer to work with, but it does not remove liquidity risk, execution risk, or the chance that traders fade the initial reaction once the first wave of attention passes.
In that sense, the headline is only the starting point. The better read is to watch how builders, exchanges, funds, wallets, regulators, or large holders respond after the first announcement has moved through the feed.
This report is based on information from platform.arkhamintelligence.com.
This article was written by the News Desk and edited by Samuel Rae.
The German government wallet has been a bearish headline machine for Bitcoin. Now that the balance is reportedly down to less than 20% of the original seized stack, traders have a new question: what happens when this particular source of selling pressure is mostly gone?
The useful way to read this is not as a guaranteed price signal, but as a fresh piece of information in a market that is trying to sort real developments from noise. That does not mean Bitcoin automatically rallies once the wallet empties. Other pressures remain. But removing a visible seller can change market psychology, especially if ETF demand and spot buyers keep absorbing supply.
For more details, visit the official Arkham platform.
TL;DR
Germany-linked wallets now hold less than 20% of the seized BTC balance.
The drawdown suggests one of the market’s clearest supply overhangs may be nearing its end.
Traders are watching whether BTC stabilizes as this pressure fades.
Why the endgame matters
Markets can often handle bad news better when they can measure it. A visible wallet with a shrinking balance gives traders a rough sense of how much supply may still be left to process.
That does not mean Bitcoin automatically rallies once the wallet empties. Other pressures remain. But removing a visible seller can change market psychology, especially if ETF demand and spot buyers keep absorbing supply.
The Market Read
Make this more market-psychology focused than the NewsBTC version.
That is the balance readers need to keep in mind. Crypto markets are quick to turn every update into a single-direction trade, but most durable stories are more layered than that. They matter because they change positioning, incentives, infrastructure, or regulation over time.
What Comes Into Focus Now
From here, the important thing is follow-through. If the source data, company update, filing, or on-chain record continues to move in the same direction, this can become part of a larger trend. If it stalls, it is still useful as a snapshot of where attention is sitting today.
For traders and readers, the cleaner takeaway is to separate the confirmed development from the speculation around it. The confirmed part is what deserves coverage. The speculation is what needs caution.
For Bitcoin readers specifically, the story is useful because it gives a clearer frame for the next few sessions. It tells them what to watch, which part of the market is reacting, and where the first obvious risk sits. That is more valuable than simply saying a token, company, or regulator has made a move. The useful work is in connecting the update to liquidity, positioning, adoption, enforcement, or user behaviour without pretending that any single headline controls the whole market.
The practical question now is whether this remains an isolated update or becomes part of a chain of follow-through. A second filing, another wallet move, fresh dashboard data, a new governance vote, or a stronger market reaction can all turn a clean single-day story into a broader narrative. Without that follow-through, it still matters, but more as a marker of where attention was concentrated on July 8 than as a complete trend on its own.
That distinction is especially important in a market where headlines can travel faster than context. A source-backed update gives readers something firmer to work with, but it does not remove liquidity risk, execution risk, or the chance that traders fade the initial reaction once the first wave of attention passes.
In that sense, the headline is only the starting point. The better read is to watch how builders, exchanges, funds, wallets, regulators, or large holders respond after the first announcement has moved through the feed.
This report is based on information from platform.arkhamintelligence.com.
This article was written by the News Desk and edited by Samuel Rae.
The most valuable real estate in crypto may not be an exchange order book anymore. It may be the wallet home screen. Bitget Wallet’s 100 million user claim is another sign that wallet providers see themselves as the front door to Web3, not just a place to store tokens.
The useful way to read this is not as a guaranteed price signal, but as a fresh piece of information in a market that is trying to sort real developments from noise. The caution is that headline user figures always need context. Active users, registered users, and retained users are different things. Even so, the scale of the claim shows how competitive the category has become.
For more details, visit the official Chainwire platform.
TL;DR
Bitget Wallet says it has surpassed 100 million global users.
The announcement points to wallet growth through swaps, dApps, and retail onboarding.
It shows how crowded the fight to own the Web3 user interface has become.
Why wallet distribution matters
A wallet that controls the user interface can influence where users swap, which dApps they try, and how often they return. That makes wallet distribution a strategic asset in the same way exchange distribution was in earlier cycles.
The caution is that headline user figures always need context. Active users, registered users, and retained users are different things. Even so, the scale of the claim shows how competitive the category has become.
The Market Read
Treat the user number as company-reported and add context.
That is the balance readers need to keep in mind. Crypto markets are quick to turn every update into a single-direction trade, but most durable stories are more layered than that. They matter because they change positioning, incentives, infrastructure, or regulation over time.
What Comes Into Focus Now
From here, the important thing is follow-through. If the source data, company update, filing, or on-chain record continues to move in the same direction, this can become part of a larger trend. If it stalls, it is still useful as a snapshot of where attention is sitting today.
For traders and readers, the cleaner takeaway is to separate the confirmed development from the speculation around it. The confirmed part is what deserves coverage. The speculation is what needs caution.
For Crypto readers specifically, the story is useful because it gives a clearer frame for the next few sessions. It tells them what to watch, which part of the market is reacting, and where the first obvious risk sits. That is more valuable than simply saying a token, company, or regulator has made a move. The useful work is in connecting the update to liquidity, positioning, adoption, enforcement, or user behaviour without pretending that any single headline controls the whole market.
The practical question now is whether this remains an isolated update or becomes part of a chain of follow-through. A second filing, another wallet move, fresh dashboard data, a new governance vote, or a stronger market reaction can all turn a clean single-day story into a broader narrative. Without that follow-through, it still matters, but more as a marker of where attention was concentrated on July 8 than as a complete trend on its own.
That distinction is especially important in a market where headlines can travel faster than context. A source-backed update gives readers something firmer to work with, but it does not remove liquidity risk, execution risk, or the chance that traders fade the initial reaction once the first wave of attention passes.
In that sense, the headline is only the starting point. The better read is to watch how builders, exchanges, funds, wallets, regulators, or large holders respond after the first announcement has moved through the feed.
This report is based on information from chainwire.org.
This article was written by the News Desk and edited by Samuel Rae.
The most valuable real estate in crypto may not be an exchange order book anymore. It may be the wallet home screen. Bitget Wallet’s 100 million user claim is another sign that wallet providers see themselves as the front door to Web3, not just a place to store tokens.
The useful way to read this is not as a guaranteed price signal, but as a fresh piece of information in a market that is trying to sort real developments from noise. The caution is that headline user figures always need context. Active users, registered users, and retained users are different things. Even so, the scale of the claim shows how competitive the category has become.
For more details, visit the official Chainwire platform.
TL;DR
Bitget Wallet says it has surpassed 100 million global users.
The announcement points to wallet growth through swaps, dApps, and retail onboarding.
It shows how crowded the fight to own the Web3 user interface has become.
Why wallet distribution matters
A wallet that controls the user interface can influence where users swap, which dApps they try, and how often they return. That makes wallet distribution a strategic asset in the same way exchange distribution was in earlier cycles.
The caution is that headline user figures always need context. Active users, registered users, and retained users are different things. Even so, the scale of the claim shows how competitive the category has become.
The Market Read
Treat the user number as company-reported and add context.
That is the balance readers need to keep in mind. Crypto markets are quick to turn every update into a single-direction trade, but most durable stories are more layered than that. They matter because they change positioning, incentives, infrastructure, or regulation over time.
What Comes Into Focus Now
From here, the important thing is follow-through. If the source data, company update, filing, or on-chain record continues to move in the same direction, this can become part of a larger trend. If it stalls, it is still useful as a snapshot of where attention is sitting today.
For traders and readers, the cleaner takeaway is to separate the confirmed development from the speculation around it. The confirmed part is what deserves coverage. The speculation is what needs caution.
For Crypto readers specifically, the story is useful because it gives a clearer frame for the next few sessions. It tells them what to watch, which part of the market is reacting, and where the first obvious risk sits. That is more valuable than simply saying a token, company, or regulator has made a move. The useful work is in connecting the update to liquidity, positioning, adoption, enforcement, or user behaviour without pretending that any single headline controls the whole market.
The practical question now is whether this remains an isolated update or becomes part of a chain of follow-through. A second filing, another wallet move, fresh dashboard data, a new governance vote, or a stronger market reaction can all turn a clean single-day story into a broader narrative. Without that follow-through, it still matters, but more as a marker of where attention was concentrated on July 8 than as a complete trend on its own.
That distinction is especially important in a market where headlines can travel faster than context. A source-backed update gives readers something firmer to work with, but it does not remove liquidity risk, execution risk, or the chance that traders fade the initial reaction once the first wave of attention passes.
In that sense, the headline is only the starting point. The better read is to watch how builders, exchanges, funds, wallets, regulators, or large holders respond after the first announcement has moved through the feed.
This report is based on information from chainwire.org.
This article was written by the News Desk and edited by Samuel Rae.
Let’s talk about something that has become one of the biggest problems in the crypto world. It’s drainers. If you haven’t heard the word before, don’t worry, you’re about to become very familiar with it. Drainers are a type of phishing attack, and they have swept through the cryptocurrency world at a truly striking pace. In fact, they are now growing so fast that they have already overtaken ransomware, both in how widespread they are and in the sheer amount of money they steal. To understand exactly how this works, we dug into the mechanics of drainers as well as the whole shadowy little market that has grown up around them. That’s what we are going to explore together today.
The basic idea behind any phishing campaign is to catch you making a mistake. Hackers want you to hand over information or access that should never leave your hands. In the specific case of drainers, the goal is a little different from classic phishing. The hacker wants to trick you into granting a smart contract permission to interact with your funds. Once you give that permission, the damage is already done. Drainers mostly go after blockchains that support smart contracts. That means they target users on Ethereum and Ethereum-like networks, such as Base, Polygon, and Optimism. But don’t think Ethereum is the only battlefield. Drainers built for Solana exist too, and a drainer aimed at Bitcoin has already made an appearance.
Imagine you want to connect your MetaMask wallet to some project’s website because you’re hoping to grab a little free crypto. Maybe you want to buy a brand-new token while it’s still cheap, before the price shoots up. You click Connect, you type in your password, and you sign a transaction that approves access to your wallet. And that, right there, is exactly the moment a drainer catches you. Instead of a legitimate contract that would let you receive tokens, the hacker gets you to sign a malicious smart contract. In doing so, you unknowingly grant permission for your funds to be transferred out. In effect, you agree, with your own hand, to give away all your money.
A selection of AI-enabled scam trends. Source: Elliptic
So how does a hacker actually pull this off? It works best with something called an airdrop, which is simply a giveaway of new tokens. Airdrops attract a swarm of people who are hoping to get a little bit of crypto that might grow tens of times in value down the road. These giveaways do genuinely happen sometimes, as a real way to promote a new token. So people have learned to trust them. In that exact moment, the user is driven by something we call FOMO, the fear of missing out on a gain.
In their rush to grab the airdrop, a person often doesn’t stop to check who actually created the page they are interacting with, or what the smart contract they are approving actually does under the hood. The website itself might be a perfect copy of the real one, built by the hacker down to the smallest detail, while the smart contract underneath does the opposite of what it promises. Instead of giving you money, it takes it.
Drainers Are Gaining Momentum
In 2024, drainers overtook ordinary ransomware, both in how far they spread and in how much money they brought in. Now, don’t get it wrong, ransomware is still very much the scourge of large businesses. But scammers, being the opportunists they are, have rushed into this new and still relatively uncrowded niche. The very first drainers spread quietly, as scripts traded on darknet marketplaces. Back in 2022 there were 55 unique forums where you could find drainers being sold or discussed. By 2024, that number had jumped to 129 such places, more than double in just two years.
And keep in mind, that count only covers a place as niche and honestly as sparse as the dark web. Most of the real action these days happens on Telegram and Discord.
The biggest drainers active in 2024 had names like Angel, Inferno, Ping, Ace, Cerberus, Nova, Medusa, MS, CryptoGrab, and Venom. Of that whole list, mainly Angel and Ace are still active today, but a new player has stepped onto the stage, one called Vanilla. It hasn’t been studied very closely yet, because it runs on a private model that is difficult for the average scammer to even get access to.
According to Scam Sniffer, a company that closely analyzes different types of crypto fraud, total losses from drainers in 2024 added up to $494.000.000.
That figure only counts the large-scale hacks that could actually be tallied and confirmed. Since drainers mostly target ordinary, everyday users, small thefts of just a few thousand dollars here and there don’t even make it into that statistic. So the real number is almost certainly much higher.
Among the large-scale cases recorded in 2024, there were more than three hundred thirty thousand victims. The single biggest theft that year came to $55.000.000. All together, there were roughly thirty major fraudulent campaigns, which is one and a half times more than the year before, in 2023. In the first quarter of 2024 alone, drainers showed almost sixfold growth. Compare that to ransomware, which only doubled over that same stretch of time.
So what do all these numbers really mean? Well, because the barrier to entry into this line of work is so remarkably low, it has started attracting scammers who used to work in more old-fashioned territory, like email phishing, luring victims to fake bank login pages and other traditional scam types. A couple of months of this kind of work could buy an apartment, a car, and regular vacations somewhere warm like Thailand. Take one risk, and you can just walk away, or so the thinking goes. But of course, once someone gets a real taste of easy money like that, nobody actually walks away after two months. The business pulls them back in.
Think about the contrast here. A ransomware group has to negotiate with a company, arrange for payment, and handle the whole business of decryption afterward. That’s a lot of hassle and a lot of steps where things can go wrong. A drainer, on the other hand, just steals the money immediately. No negotiation needed.
Like plenty of other kinds of scams out there, drainers are distributed under what’s called a SaaS model, short for Software-as-a-Service. In this criminal corner of the internet, they’re called DaaS, meaning Drainer-as-a-Service.
There’s also a very characteristic division of labor inside these operations. You’ve got developers, who build the actual malware. You’ve got workers, the rank-and-file operatives out doing the scamming day to day. And alongside them you’ve got recruiters, traffic-generation specialists, and providers of various supporting services that keep the whole machine running. The main job, naturally, falls to the developers. They are the ones who create the malicious software and work to make it more convenient to use, easier to deploy, and easier to scale up.
How the “Company” Is Built
So what does a hacker actually need in order to pull off a phishing campaign like this?
First, they need domains for their future sites, and these domains are usually spelled just similarly enough to the name of the real project they’re impersonating, so a distracted eye won’t catch the difference. Then they need hosting, which is simply a place to put the site once it’s built. Naturally, they also need a landing page, one designed to closely resemble the legitimate project’s real page. Underneath that landing page sits the drainer code itself, which is typically JavaScript code hosted directly on the site. On top of all that, they’ll usually build a control panel that shows them how many users have been lured in and tracks how those users are behaving on the page. And finally, hackers take their own security seriously too, relying on VPNs, proxies, and fake sockpuppet accounts to cover their tracks.
Source: Elliptic
Professional hackers usually go a step further and set up a full command-and-control server, which lets them manage the drainer’s behavior remotely and adjust it on the fly.
Once all of that infrastructure is in place, all that’s left is bringing in people, actual victims to walk through the trap. That job falls to traffic arbitrage specialists, sometimes called traffic drivers. Their whole task is to funnel users toward the phishing page. They accomplish this in all sorts of ways, everything from buying Google ads to jumping directly into comment sections and posts to engage with real users. Some scammers even go so far as to clone the official support channels of legitimate projects, so a victim reaching out for help ends up talking to the scammer instead.
Put it all together, and what you get is a genuine sales funnel, a designed path that walks victims toward the trap, just like any legitimate marketing funnel would walk a customer toward a purchase.
How the Money Is Split
Here’s how the profits typically get divided up. Operators, the people running the overall scheme, take home twenty to thirty percent of whatever gets stolen. The rest goes to the workers, the people directly out there scamming victims day to day. A worker’s exact cut depends on their skill level. Beginners give up thirty percent of their take to the operators, while the most experienced workers only give up ten to fifteen percent.
And how is a worker’s skill level judged? Simply by how much they have already managed to steal over time. If you’ve stolen up to $10.000 total, you’re considered a beginner. Between $25.000 and $30.000 puts you at mid-level. And starting from $100.000, usually climbing toward a million or more, you’re considered a true professional in this dark little trade.
Driving Traffic
Knowledge in this underground world gets passed around among workers through tutorials. A tutorial itself becomes an item that gets bought, sold, and traded, almost like a piece of merchandise. Entire communities have formed just to gain access to these tutorials, treating them like valuable trade secrets. The writing style of these tutorials makes it fairly clear that AI tools were used to help put them together.
Broadly speaking, the same traffic-driving scheme used in ordinary, everyday phishing applies here too, just adapted for the world of crypto. A worker is essentially doing the same job as any online advertising specialist would. Their goal is simply to increase the number of people clicking through to the phishing page. That means hunting for users who are genuinely interested in Web3 and DeFi projects, people who hold crypto wallets and who are drawn to airdrops, token swaps, and exchanges.
Sample texts (lifted verbatim from actual cases) from pig butchering scammers. Source: Elliptic
This whole process involves demographic analysis and geolocation analysis, essentially the same ordinary targeting techniques that any advertiser in any industry would recognize. Workers also handle what they call “site design,” which really just means cloning the pages of existing, trusted projects. They’ll even use classic marketing techniques like A/B testing to see which fake page tricks more people.
Now let’s walk through a few high-profile examples of drainer thefts.
The Attack on Arkham Intelligence
Arkham is a company that provides on-chain analytics, and it’s a genuinely popular tool for tracking transactions. Traders rely on it, for instance, to check an asset’s price and see exactly where it’s trading across different platforms.
Back in 2023, Arkham’s owners launched their own token along with an airdrop of coins to celebrate. But hackers saw an opportunity and created numerous fake profiles on X specifically to redirect users toward phishing pages containing a drainer. Remarkably, these bot accounts proved quite resilient and managed to avoid being banned for a long stretch of time. They mimicked Arkham’s real activity closely and spread malicious links far and wide.
A huge number of these fake sites were created during the campaign, and each one typically had a lifespan of just weeks, or a couple of months at most. Angel’s software allowed a hacker to copy landing pages quickly and place them on brand-new domains almost instantly. The whole process has been simplified so much that a worker only needs to type a few commands into a conversation with a Telegram bot in order to deploy an entirely new phishing site.
The Attack on the SEC
An even bigger impact can be achieved by a hacker hijacking the real, verified account of some authoritative company, or even a government organization.
And that’s what happened with the United States Securities and Exchange Commission, or the SEC. On January 9, 2024, its account on X was compromised through a technique called SIM swapping, which basically means reissuing a SIM card tied to the phone number linked to that account. Officials, unfortunately forgetting about basic security hygiene, hadn’t even enabled multi-factor authentication on the account.
Lately, the SIM-swapping community and the drainer community have grown noticeably closer, almost like two neighboring criminal industries starting to collaborate. Swappers now routinely supply drainers with freshly hijacked accounts to use.
The hackers behind this attack posted that the SEC had officially approved investing in Bitcoin without needing to buy crypto directly on an exchange like Binance or Coinbase. This caused an immediate stir, because investors had been waiting a long time for exactly this kind of decision from the SEC, and many expected it to be announced any day. Following the fake post, the hackers urged people to claim an “official SEC airdrop” on a special site that contained a drainer.
That single fake post even caused a real spike in Bitcoin’s price. It rose by a full thousand dollars, just from a fake tweet.
Scamming the Scammers
Scammers, as it turns out, wouldn’t really be scammers if they didn’t also scam each other. At one point, the developer behind the Pink Drainer felt like he was getting close to being unmasked, so he decided to get out of the game entirely and cash out his loot. Here’s the catch, though. You can’t just sell crypto obtained through a scam outright. To actually withdraw the funds, a scammer first has to launder the money, or else an exchange might get suspicious and freeze it before it ever reaches a real bank account.
To avoid enabling things like terrorism financing, or simply to stay within the law, exchanges use a system of scoring and refuse to accept “dirty” crypto. This scoring system is called an AML score, short for anti-money-laundering. There are plenty of laundering methods out there, and while trying one of them, Pink Drainer’s own developer ended up getting scammed himself. He fell for one of the simplest kinds of fraud imaginable called address poisoning.
Here’s how it works. Hackers generate crypto addresses that closely resemble a victim’s real address, and then they send that victim a tiny amount of crypto, just enough so that the lookalike address shows up in the victim’s transaction history.
An example of a custom ETH wallet address generator used for address poisoning. Source: Elliptic
From the user’s side, here’s what it looks like in practice. You send, say, one hundred dollars to some other wallet, maybe an exchange you use regularly. Then, five or ten minutes later, you receive a few tiny transfers that appear to come from that very same wallet. But in reality, they only come from a similar-looking address, one that might share, say, an identical start and end to the real address, while the middle is different.
The hacker is betting that on your next transfer, you’ll simply scroll through your history, pick the most recent address you see, and send your money not back to yourself, but straight into the hacker’s pocket. And that’s exactly how Pink Drainer got caught in his own kind of trap. He picked what looked like the last transaction in his history and sent ten ETH, worth about $15.000 at the time, straight to some unknown “colleague” who was never really his colleague at all.
Conclusion
Because draining is so easy and profitable, this type of scam is not going away anytime soon. If anything, the ways malicious payloads get delivered will only keep getting more sophisticated from here. Drainers are increasingly setting their sights on younger blockchains too. On Ethereum-based networks, it’s steadily getting harder for hackers to operate, since protective measures keep appearing that they have to find new ways to bypass. On Solana, though, no such protections really exist yet, which makes it a much softer target. New kinds of drainers will keep emerging as well. Some scammers have already started building actual apps for Google Play and the App Store, moving beyond simple websites and into places millions of people trust by default. So stay alert out there, and think twice before you click any button, especially one promising you free money. If it feels too good to be true, in crypto more than almost anywhere else, it usually is.
If you’re interested in cryptocurrency forensics, we have a dedicated training called Bitcoin and Cryptocurrency Forensics. You will get to dive into blockchain analysis and cryptocurrency investigations, learning the skills needed to become a cryptocurrency forensic analyst. You can buy the training separately or attend it live on September 15-17 at 3 PM UTC.
The SEC has ended its investigation into MetaMask swap and staking services, according to Consensys, handing Ethereum wallet builders a significant regulatory relief signal.
For more details, visit the official Consensys platform.
TL;DR
Consensys says the SEC has closed its MetaMask swaps and staking investigation.
The decision removes a direct enforcement threat against one of Ethereum’s most important retail wallets.
Wallet developers still face policy uncertainty, but the immediate pressure has eased.
MetaMask is not just another app in the Ethereum stack. It is one of the main doors through which retail users reach DeFi, NFTs, staking, and on-chain transactions. That is why an investigation into MetaMask services carried broader implications than a single company dispute.
A Big Signal For Wallet Infrastructure
If regulators had pursued a broad case around wallet-integrated swaps or staking features, it could have forced wallet developers to rethink how much functionality they can safely offer inside non-custodial interfaces. The closure does not answer every legal question, but it reduces one immediate fear.
For Consensys, the decision supports its argument that wallet software should not be treated like a traditional broker just because it helps users interact with protocols. That debate is far from over, but the company now has a better headline than it did before.
Why Ethereum Cares
Ethereum’s growth depends on wallets becoming simpler, not less useful. If compliance risk forces wallets to strip out features, the user experience suffers. If wallets can keep improving while regulators clarify rules, the ecosystem has a better chance of bringing mainstream users on-chain.
The market should not treat the closure as a blanket legal victory for every DeFi front end. But for MetaMask and Ethereum wallet infrastructure, it is a meaningful step away from the harshest enforcement scenario.
This article is based on information from Consensys.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information from Consensys. at Consensys
Vitalik Buterin is again pressing on one of Ethereum’s most awkward user-experience problems: Layer 2 networks may be cheaper than mainnet, but the wider ecosystem still feels fragmented, unpredictable, and too hard for normal users to navigate.
Vitalik Buterin has floated ideas around Layer 2 gas-fee structure and cross-L2 wallet standards.
The goal is to make Ethereum scaling feel less fragmented for users.
The debate comes as L2 networks compete for liquidity while Ethereum tries to preserve a unified ecosystem.
Ethereum’s roadmap has leaned heavily on Layer 2 networks to scale activity. That strategy has worked in one sense: fees are lower, more applications can run, and users have more options. But it has also created a new problem. Moving across L2s often feels like using separate chains rather than one coherent Ethereum economy.
The L2 Problem Is No Longer Just Fees
Gas costs still matter, but the bigger issue is consistency. A user may hold assets on one rollup, need liquidity on another, and rely on a wallet that handles each network differently. That friction weakens the promise that Ethereum scaling should feel invisible.
Buterin’s comments point toward structural changes around fee handling, wallet standards, and cross-L2 coordination. The market should read that as a sign that Ethereum’s next competition is not only with rival Layer 1s. It is also with its own complexity.
Why This Matters For ETH
If Ethereum can make L2 usage smoother, it strengthens the case that the ecosystem can scale without sacrificing decentralization or liquidity. If it cannot, users may keep treating each rollup as a separate island, and rival chains will keep selling simplicity as a feature.
The good news is that Ethereum developers are talking openly about the problem. The harder part is turning standards into behaviour across wallets, bridges, sequencers, and applications that all have their own incentives.
This article is based on Vitalik Buterin’s public post on X.
This article was written by the News Desk and edited by Samuel Rae.
Login
