Crypto drainers are becoming products
A drainer generally does not break a wallet’s cryptography. It attacks the user.
BrefCrypto had already documented malware capable of directly targeting wallets and exchange accounts. Drainers use a different approach: the victim is lured to a fake website, an airdrop, a dApp or an operation presented as legitimate, then prompted to sign an authorization they do not fully understand.
Once that permission has been granted, the attacker can, in some cases, move the relevant tokens without requesting a new approval.
Chainalysis precisely describes drainers as Web3 phishing tools designed to persuade users to connect their wallet and approve transactions giving the operator control over certain funds.
What is changing today is the criminal market built around this technique.
The listings in question offer several versions depending on the blockchain targeted, with prices ranging from a few hundred to several thousand dollars. The same seller reportedly also advertises MEV bots and other Web3 tools.
The exact amounts of $700 to $7,000 remain difficult to independently confirm in open sources. The business model, however, is no longer really in doubt. SOS Intelligence says it tracks tutorials sold for as little as $50 in criminal communities, as well as fully operational Solana kits priced at around $1,000.
Malware is becoming a product.
Attackers no longer need to code everything themselves
This is probably the most concerning aspect.
Previously, a cybercriminal needed the skills to build the phishing website, understand interactions with smart contracts, analyze the wallet’s tokens and automate the recovery of the assets.
Kits lower that barrier.
Some criminal offerings already operate on a Drainer-as-a-Service model: developers provide the infrastructure, while affiliates mainly focus on attracting victims. In other cases, the software is sold directly.
Blockaid, for example, tracks AngelFerno, an operation targeting several ecosystems, including EVM chains, TRON and XRP. Its operators notably use pre-prepared social media accounts and fake crypto applications to distribute their malicious links.
This is part of a broader shift in cybercrime. BrefCrypto had already reported $12.7 billion in suspicious activity linked to major crypto scam factories. An organization no longer needs to have every skill in-house. It can buy access, rent the malware, obtain a victim database or pay another group to launder the funds.
Even scams are increasingly using artificial intelligence. Chainalysis estimates that addresses associated with scams received at least $14 billion in 2025, with the total potentially exceeding $17 billion as new addresses are identified. In its data, scams using AI were 4.5 times more profitable than those that did not.
Drainers fit perfectly into this industrial chain.
The real risk is now the signature
This industrialization is also changing security habits.
Owning a hardware wallet does not automatically protect against a transaction that its owner authorizes themselves. If the screen displays a poorly understood permission and the user signs it, the wallet’s physical protection has not technically been broken.
On EVM-compatible networks, some attacks notably exploit approval mechanisms that allow an application to use tokens. TRON has a comparable mechanism with TRC-20 allowances. A permission can sometimes remain active long after the website that requested it has been closed.
That is why “disconnecting” a wallet from a dApp is not always enough. An authorization that has already been granted may need to be revoked directly on-chain.
The best precaution is therefore fairly unglamorous: read what you are signing, avoid links received in private messages, separate the wallet used to interact with dApps from the wallet holding your main savings, and limit permanent permissions.
BrefCrypto had already observed how Coinbase, Meta and other companies are now attacking scam networks at the infrastructure level. The problem nevertheless continues to shift: when one criminal service disappears, another kit can be sold to new operators.
That is where the catalogue priced at several thousand dollars becomes significant.
The danger is no longer only that a highly skilled hacker knows how to drain a wallet. The danger is that someone far less skilled can buy the tool needed to try.
The Web3 criminal economy is therefore beginning to replicate what ransomware had already done before it: turning a complex technical skill into a commercial service accessible to affiliates.
