Drainer-as-a-service
Drainer-as-a-service (DaaS) is a criminal business model in which a developer rents a wallet-drainer kit to affiliates and takes a percentage of every theft.
How it works
Affiliates pay a deposit or simply sign up, deploy the kit on their own phishing sites and drive traffic with ads, fake airdrops and hacked social accounts. The smart contract or backend splits the stolen assets automatically, typically 20–30 % to the developer.
Known families include Inferno, Angel, MS and Pink Drainer; their domains share code and contract patterns.
Example from the PhishDestroy database
- app-changelly.net: Domain running a named drainer family, first detected 2026-10-12.
- changelly-eng.com: Domain running a named drainer family, first detected 2026-10-12.
- changelly-app.org: Domain running a named drainer family, first detected 2026-10-11.
How to protect yourself
- Follow the wallet-drainer precautions: read every signature and keep valuable assets in a wallet that never connects to new sites.
- Report the drainer contracts and the phishing domains together.