Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
What Is Drainer-as-a-Service?
How DaaS turned crypto phishing into a subscription business — and what you can do to protect your funds before it hits.
Drainer-as-a-service (DaaS) is a criminal subscription model where software developers sell or rent ready-made crypto wallet-stealing tools to scammers who use them to phish and drain victims’ wallets.
Think of it as the dark-web version of a SaaS startup. The developer builds the product, ships updates, and runs support on Telegram. The scammer pays a subscription fee or hands over a cut of every theft. The victim never signed up for anything.
DaaS did not invent crypto phishing. It industrialised it. Running a wallet-draining scam used to take real programming skill. Now it takes a Telegram account and a share of the proceeds. That shift is why drainer losses keep climbing. Below, you will see how these attacks reach your wallet and how to shut the door before they do.
Key Takeaways
- Drainer-as-a-service is a criminal SaaS industry where developers sell wallet-draining tools to non-technical scammers on a subscription or revenue-share basis.
- Operators typically take 20-30% of each theft automatically, via the drainer smart contract itself — no trust required between operator and affiliate.
- $494 million was stolen via crypto drainers in 2024, a 67% rise from the year before, driven by the low skill bar DaaS created.
—
What Drainer-as-a-Service Actually Is
A drainer is software built to sweep the most valuable assets from a connected wallet. It fires the moment a victim signs a transaction or approval. Drainer-as-a-service is the business layer on top of that software. It is a criminal SaaS market where draining tools get sold, rented, and supported like any commercial product.
Three parties make it work. The operator is the developer who builds the drainer, packages it as a deployable kit, and handles maintenance. The affiliate runs the scam: fake website, phishing links, and a steady flow of victims. The victim is anyone who connects a wallet to that fake site and signs a request they did not fully read.
The business terms are brutal in their simplicity. Affiliates usually pay 20-30% of every theft to the operator. That cut is hardcoded into the drainer contract and transfers automatically. No invoices. No trust required. Some operators charge an upfront kit fee on top, roughly $500 to $10,000 depending on features. Others run pure revenue share.
So the person behind the fake OpenSea clone that drained your wallet is probably not a programmer. They rented the weapon from someone who is. That split between skill and execution is what set drainer-as-a-service apart from earlier phishing, and what let the industry scale so fast.
One quick distinction, since people mix them up. Some victims confuse a drain with rug pull mechanics. The two are different. A rug pull exits a token project. A drainer targets your wallet directly through a signing request.
—
How a Drainer-as-a-Service Attack Works
The attack chain looks the same across operators and targets. Here is how it runs from first click to empty wallet.
First, the affiliate builds a fake site that impersonates a real protocol. Think OpenSea, Uniswap, a hyped NFT mint, or a fresh airdrop. The design is often pixel-perfect. The URL sits one swapped letter, one extra hyphen, or one different TLD away from the real one. The link then spreads through Discord DMs, hacked X accounts, Telegram groups, or fake Google Ads. Victims arrive sure they found the genuine site.
Next comes “Connect Wallet.” This step feels completely normal, because you connect to legitimate sites all the time. Once you are connected, the site pushes a transaction or a signature request. That request is the whole point of the attack.
Here is what most people miss. Drainers increasingly lean on a vector called Permit2 or EIP-2612, a “sign-typed-data” or “gasless approval” prompt. On screen it reads like a plain message signature, not an on-chain transaction. No gas fee. No line that says “token transfer.” So victims later swear “I didn’t sign anything.” They did. They signed a message that handed the drainer contract permission to move their tokens, and the contract acted on it instantly.
Then the drainer sweeps the wallet. NFTs and high-cap tokens go first, then anything else it can reach. The proceeds split on their own, one wallet for the operator, another for the affiliate. The whole sweep usually finishes in seconds. Fake airdrop pages sometimes bait you with fake token rewards so the first click feels legitimate before the drain runs.
None of this is a hack in the usual sense. Nobody cracked your private keys. Nobody broke into an exchange. You signed something, and the contract did exactly what it was built to do.
—
The Drainer-as-a-Service Business Model
DaaS is not random opportunism. It runs like an organised market, with product tiers, support channels, update cycles, and clear revenue splits. That structure is why it kept growing even after several big operators announced shutdowns. The market filled the gap within weeks.
The revenue model stacks in three layers. Kit sales come first: a one-time or recurring fee for the phishing software, usually $500 to $10,000 by operator and feature set. Then ongoing revenue share, the 20-30% cut pulled automatically from every drain. On top of that sit add-on fees for anti-detection updates, new chain support, and premium extras like Permit2 bypass modules.
The named operators show how far this reaches. Each one below ran at real scale before exiting or going quiet:
| DaaS Operator | Reported Scale and Status |
|---|---|
| Inferno Drainer | Announced shutdown Nov 2023, relaunched covertly. 30k victims and $9M in losses between Sep 2024 and Mar 2025 (Check Point Research) |
| Pink Drainer | Operated through mid-2024 then exited. Responsible for tens of millions in losses |
| Angel Drainer | Required a $5k-$10k entry deposit. Operated alongside Inferno at peak |
Those are only the ones with names. The full picture is denser. Research presented at the ACM Internet Measurement Conference mapped 56 core operators controlling 87,077 transactions across 1,910 profit-sharing smart contracts. Just three crime families took 93.9% of the profits. That is not a scattered grey market. It is a structured criminal industry with a handful of kingpins.
The ransomware-as-a-service comparison fits well. Operators run Telegram support, push version updates, and some even offer white-labelling. The anti-money laundering pressure on crypto that hits exchanges barely touches these proceeds. Funds split across many wallets, chain-hop fast, and pass through mixers long before they reach any exchange.
—
Why Drainer-as-a-Service Losses Kept Growing
The numbers leave little room for doubt. According to Scam Sniffer’s 2024 phishing report, crypto drainers stole $494 million in 2024. That is a 67% jump from $164 million in 2023. Victim counts rose too, but average losses rose faster. So attackers were hunting wealthier wallets, not just casting a wider net.
Ethereum stayed the main hunting ground. It carried 85.3% of the 30 largest single-victim thefts in 2024. The reason is structural. Deep liquidity, high-value NFTs, and the ERC-20 approval model create a target-rich environment. The permit standard, EIP-2612, is native to Ethereum, which puts gasless approval exploits within easier reach there than on other chains.
Still, this is not an Ethereum-only problem. Solana is an emerging target, and BNB Chain has seen active campaigns. If you are off Ethereum, you are not safe. You are just less targeted for now.
The real growth driver is access. DaaS pushed the skill bar for running a drain close to zero. Dark-web threads discussing drainer kits jumped 135% in 2024, tracking that same accessibility curve. Any affiliate who can spread links and run a fake site can operate. No Solidity required.
Distribution then multiplies the damage. Phishing and wallet-theft domains flagged in 2024 ran into the hundreds of thousands. Attackers often layer volume spoofing onto cloned frontends so the fake site looks like a live, busy marketplace. That extra polish makes the trap more believable before you ever connect.
—
How to Check Your Wallet for Drainer-as-a-Service Exposure
Connected your wallet to a site you no longer trust? Do not wait to find out. Three signals tell you something may be wrong, and two tools let you check them fast.
Start by scanning for these three warning signs right now:
- An unexpected outbound transaction you do not recognise in your wallet history.
- A token approval you did not intentionally set — visible in Etherscan’s Token Approval Checker.
- A “permit” or “sign-typed-data” entry in your signed messages history that granted token access without a visible on-chain transaction.
The two tools for the job are Revoke.cash and Etherscan’s Token Approval Checker. Both let you connect your wallet, see which contracts can move your tokens, and revoke anything you do not recognise. Each revoke costs a small gas fee. Pay it anyway.
Here is how each warning sign maps to a concrete move:
| Warning Sign | What To Do |
|---|---|
| Unfamiliar outbound transaction in wallet history | Check the contract address on Etherscan — if it links to a known drainer, move remaining assets immediately |
| Token approval you didn’t set | Go to Revoke.cash, connect wallet, find and revoke the approval |
| Permit signature in signed messages (no on-chain transaction) | Standard approval scanners may miss this — check your wallet app’s full signing history and revoke via Revoke.cash if accessible |
| Wallet connected to an unknown site but no transaction shows | Still run the approval check — Permit2 approvals may not appear as standard entries |
One caveat before you relax. Permit2 approvals sometimes never surface in standard scanners. So if you signed a “sign-typed-data” request but Revoke.cash looks clean, open your wallet’s raw signed-messages log instead. MetaMask and most hardware wallets keep the full history.
One more trap. Fake Revoke.cash clones exist. Check the URL reads exactly revoke.cash before you connect anything. Scammers push fake revoke tools that drain you a second time. That is a documented attack, not a hypothetical.
—
Protecting Your Wallet from Drainer-as-a-Service Attacks
Six habits cut your drainer-as-a-service exposure sharply. Each one blocks a specific step in the attack chain above.
Use a hardware wallet for anything valuable. Ledger and Trezor demand a physical button press for every signing request, and they show the full request first. That makes automated draining far harder to pull off. But be honest about the ceiling. A hardware wallet guards your keys and slows your decisions. It will not stop you signing a malicious Permit if your own thumb confirms it. The protection is real, not absolute.
Keep a burner wallet for new protocols. Fund it with only what the interaction needs. If the site turns out malicious, that small amount is the whole loss. Your main stack never touches it.
Audit your token approvals monthly at Revoke.cash. Most wallets pile up dormant approvals from protocols you tried once and forgot. Each one is a door left open.
Never sign a Permit or sign-typed-data request on a site you do not know. These prompts mimic a plain message signature, not a transaction. No gas fee. Barely any detail. If you cannot vouch for the site asking, close the tab.
Check URLs character by character before you connect. Attackers hide behind Unicode lookalikes, extra hyphens, and alternate TLDs that pass a quick glance.
Stay suspicious of surprise airdrop invites, DM’d NFT mints, and urgent Discord pings. Those are the main channels drainer phishing rides in on.
There is one thin safety net worth knowing. When drainer proceeds land at a centralised exchange that runs KYC, there is a slim chance the exchange flags or freezes them. Do not count on it as recovery. But it is exactly why sophisticated attackers route stolen funds through KYC’d venues last, if ever.
—
What To Do If a Drainer-as-a-Service Attack Already Hit You
Start with the hard truth. Recovering stolen crypto is almost always impossible. Blockchain transactions are irreversible. No support desk, dispute team, or government agency can claw back funds that already moved. So the only real goal now is damage control.
Work through these steps in the first 60 minutes:
- Do not send more funds to the compromised wallet. Any additional assets sent there are also at risk if active approvals remain.
- Go to Revoke.cash immediately and revoke all active approvals on the compromised address. Drainers sometimes sweep in batches — revoking may stop a second wave before it executes.
- Move any remaining assets to a completely fresh wallet you have never connected to any site. Do not reuse the compromised address.
- Do not use the compromised wallet again — even after revoking all approvals. Its history makes it a known target for follow-on phishing.
- Report the phishing site to Phish.Report and Google Safe Browsing. This does not recover your funds, but it gets the domain flagged faster and protects other users.
- Document the transaction hashes of the drain transactions. If you file a police report or work with a blockchain analytics firm, these are the starting points.
One last thing. Victims often feel ashamed, sure they should have spotted it. They should not. Seasoned traders, developers, and security pros have all been caught by these kits. A drainer-as-a-service prompt is engineered to look identical to a legitimate signing request. The fault sits with the attackers, not with you.
—
FAQ
What is drainer-as-a-service in crypto?
Drainer-as-a-service (DaaS) is a criminal business model. Developers build wallet-draining tools, then sell or rent them to scammers who phish crypto users. Think of it as a triangle. The developer is the operator, the scammer is the affiliate, and the victim is anyone who connects to a fake site and signs a malicious request. Operators skim 20-30% of each theft automatically. At scale, drainers stole $494 million in 2024 alone.
Can a drainer steal crypto without you signing anything?
No. Every drainer attack needs at least one action from you: connecting a wallet, approving a transaction, or signing a message. The confusion comes from the Permit and sign-typed-data vector. That prompt shows up as a plain message signature, with no gas fee and barely any detail, instead of an obvious token approval. So people report they “didn’t sign anything” when they actually signed a gasless permit that handed the drainer full access to their tokens.
Does a hardware wallet protect you from drainer-as-a-service attacks?
A hardware wallet raises the bar, but it is not a force field. Ledger and Trezor keep your keys off the internet and force a physical press on every signing request. That alone makes automated draining much harder. Yet the device will still let you approve a malicious Permit if you confirm it yourself. The protection is meaningful, not absolute. Pair the hardware with URL checks and a burner wallet for new interactions, and you have the strongest practical setup.
How does a drainer-as-a-service operator get paid?
The operator’s cut, usually 20-30% of each theft, is hardcoded into the drainer contract. It transfers automatically the moment the drain fires. No manual payment. No trust required. The affiliate keeps the remaining 70-80%. Some operators also charge an upfront kit fee of $500 to $10,000 on top. That automatic split is a big reason DaaS scaled so fast, because operator and affiliate never have to negotiate.
Are drainer-as-a-service attacks only on Ethereum?
Ethereum dominates. More than 85% of major drainer losses in 2024 hit Ethereum, thanks to deep liquidity, high-value NFTs, and the ERC-20 approval model. But Solana, BNB Chain, and 30-plus EVM networks are all in scope. DaaS kits increasingly ship multi-chain support as a selling point. So if you trade off Ethereum, do not assume drainer-as-a-service attacks skip your chain.
—
Where To Start
Four moves are worth making this week, in priority order. Most people skip all four until something has already gone wrong.
Check your active token approvals now. Open revoke.cash, connect your wallet, and read the list. Revoke anything you do not recognise, especially old approvals from sites you barely remember. It costs a little gas and takes five minutes. Do not wait for a scare. Every dormant approval is a door left open.
Spin up a burner wallet for new protocols. Create a fresh address, fund it with only what the interaction needs, and use it for that session alone. If the site turns out malicious, that small balance is the whole risk. Your main holdings never touch the unfamiliar site. It is the cheapest security upgrade you can make.
Lock down signing on your hardware wallet. On Ledger or Trezor, find the blind-signing setting. It is off by default on most devices, and it should stay off unless a verified protocol truly needs it for a transaction you understand. With blind signing on, the device cannot show what you are approving. That blind spot is exactly what a drainer needs.
Bookmark the tools you trust. Save revoke.cash and Etherscan’s Token Approval Checker directly. Type each URL yourself the first time, verify it, then bookmark it. Never search “revoke approvals crypto” in a panic, because that results list is where attackers plant fake clones. Getting drained twice while fixing the first drain is a known pattern.
