ScamIntelLogs Investigation
We dissect three drainer-as-a-service operations at the code level: AI-generated phishing kits with debug statements still in production, an 80%-commission affiliate model fueling rapid expansion, and one archived network proving that coordinated disruption works. This is the infrastructure behind the next wallet you almost connected to.
Every crypto drainer follows a predictable sequence. What makes drainer-as-a-service operations dangerous is their scale: the same attack chain gets replicated across dozens of domains, each one a fresh trap for unsuspecting victims. The sequence below was extracted step by step from TRXDrop's source code.
This 9-step chain was reconstructed from decompiled TRXDrop source code. Every step is documented with corresponding code references in the ScamIntelLogs repository.
fbf5b42d9006502246e73447f5d50e33. Victim connects their wallet believing it is required to
claim.
approve()
transaction granting the drainer contract unlimited spend
authority over specific tokens.
setApprovalForAll(), granting the attacker control over NFTs and all token types
in the wallet.
transferFrom()
to move all approved tokens to the attacker's collection
wallet.
If a victim clicks "Reject" on the signing prompt, the TRXDrop code immediately re-triggers the request. This loop repeats 50 times before the victim is allowed to close the modal. Most users give up and sign after 3-5 attempts, believing the site is glitched rather than malicious. The loop is there on purpose.
TRXDrop is an Angel Drainer reseller targeting TRON and Solana wallets. What sets this operation apart is how unsophisticated it is. The source code reveals unmistakable markers of AI-assisted development: repetitive structure, verbose commenting, and most tellingly, over 30 console.log debug statements left in production code.
An experienced developer does not leave marks like these. They point to someone who prompted an LLM to write a drainer and deployed the output without review.
The TRXDrop codebase contains 30+ console.log debug statements in the production build. Messages like console.log("Attempting wallet connection...") and console.log("Approval transaction sent") appear throughout. Neither a professional developer nor an experienced criminal ships debug logging to production. This is raw LLM output, deployed as-is.
All communication between the drainer frontend and backend panel is encrypted with a hardcoded XOR key: TRX_SECURE_2024_PANEL_KEY. XOR with a static key is trivially reversible, which is another indicator of copy-paste development.
WalletConnect Project ID fbf5b42d9006502246e73447f5d50e33 is embedded in all 15+ domains. A single revocation of this project ID would disable wallet connectivity across the entire TRXDrop network simultaneously.
The signing prompt loop retries 50 times before allowing the victim to exit. This psychological pressure tactic is hardcoded as a core feature of the Angel Drainer kit, and affiliates cannot configure it.
Each successful drain sends a 30 TRX commission to the operator wallet. At current rates, this is approximately $7-8 USD per victim. A margin that low suggests the operation depends on volume over value.
Telegram: @STNlRAWbIaFLiH (User ID: 6823931109)
Collection Wallet: TRAGn9E6hbTiQrYG5V4sk1gNv3JaWHSxak
Chains Targeted: TRON, Solana
Drainer Kit: Angel Drainer (resold/customized)
| Domain | Type | Status |
|---|---|---|
trx-drop.com | Primary landing | Active |
tronrefund.com | Refund lure | Active |
tronfund.net | Fund lure | Active |
trxfund.pro | Fund lure | Active |
trxairdrop.io | Airdrop lure | Active |
trondrop.org | Airdrop lure | Active |
tronreward.com | Reward lure | Active |
tronreward.net | Reward lure | Active |
tronrefund.net | Refund lure | Active |
trxfund.org | Fund lure | Active |
trxdrop.com | Airdrop lure | Active |
trxdrop.org | Airdrop lure | Active |
trongiving.com | Giveaway lure | Active |
tronclaims.com | Claims lure | Active |
trondrop.pro | Airdrop lure | Active |
NiceCrypto operates on a simple proposition: give affiliates the highest payout in the drainer market, and they will bring the victims. At 80% commission, NiceCrypto offers the most generous affiliate split we have documented in any drainer-as-a-service operation. The operator keeps just 20%, a razor-thin margin that only works at scale.
If an affiliate drains a wallet containing $1,000 in tokens, they keep $800 and NiceCrypto takes $200. With $8,454+ in documented affiliate payments, the operation has processed a minimum of $42,270 in stolen funds, and that figure only covers payments we can observe directly on-chain.
$8,454+ in documented payments to affiliates is only the floor. At an 80% affiliate rate, total stolen funds processed by NiceCrypto exceed $42,000 minimum. The true figure is likely significantly higher, as not all transactions are captured in our monitoring window.
NiceCrypto started on TRON but configuration files recovered from their infrastructure reveal active expansion to Solana, EVM-compatible chains (Ethereum, BSC, Polygon), and TON. That puts four blockchain ecosystems under a single drainer panel.
NiceCrypto recruits affiliates through wwh2club.to, a known cybercrime forum. Their Telegram bot @NCsetup_bot handles onboarding, and new affiliates receive a configured drainer kit within minutes of contact.
NiceCrypto's website domain wasabihub.one raises questions about a possible connection to the WasabiSquad operation. Whether this is shared infrastructure, a rebrand, or coincidence requires further investigation.
Bot @NCsetup_bot automates affiliate management: deployment of drainer kits, commission tracking, and payout distribution. The operator rarely needs to interact with affiliates directly.
Telegram Bot: @NCsetup_bot
Website: wasabihub.one
Forum: wwh2club.to
Affiliate Commission: 80%
Documented Payouts: $8,454+
Chains: TRON (active), Solana (expanding), EVM (expanding), TON (expanding)
717Team is the proof that these operations can be stopped. With 125 members and 85 tracked wallets, 717Team was a mid-sized drainer operation running 12+ phishing domains. The confirmed drain total of $2,946.25 may seem modest compared to larger operations, but what matters here is the outcome: archived.
In our tracking system, "archived" means the operation has been disrupted to the point of cessation: its domains taken down, its infrastructure burned, and its admin exposed. 717Team did not shut down voluntarily; it was shut down through coordinated reporting, domain takedowns, and intelligence sharing with blockchain security partners.
717Team's ARCHIVED status is not a label we apply lightly. It means sustained disruption across multiple vectors: domain takedowns, hosting provider reports, wallet flagging, and exposure of admin identity. The operation's cost of continuing exceeded its revenue. That is what successful disruption looks like.
Admin Telegram handle @imdebank (User ID: 7149807602) has been linked to RublevkaTeam, a separate Russian-language scam network previously documented in our TON investigation. Cross-operation admin sharing is a recurring pattern.
125 members were tracked across Telegram groups and 85 wallets identified through on-chain analysis, with $2,946.25 confirmed drained. 717Team recruited through lolz.live, a Russian-language cybercrime forum.
12+ domains including checkscore.cc, cryptomus-payment.com, check-score.ru, and others. Multiple domain registrars used in an attempt to resist coordinated takedowns.
Telegram bot @team717_bot managed affiliate coordination, victim tracking, and payout distribution. The bot was deactivated as part of the disruption effort.
Admin: @imdebank (ID: 7149807602)
Linked Group: RublevkaTeam
Bot: @team717_bot
Forum: lolz.live
Members: 125 tracked
Wallets: 85 identified
Confirmed Drained: $2,946.25
Status:ARCHIVED (Disrupted)
TRXDrop deploys two anti-analysis techniques that are standard in the drainer toolkit playbook. Both are designed to frustrate casual inspection, but neither poses a meaningful obstacle to a trained analyst.
A setInterval loop fires every 1,000 milliseconds and executes a debugger statement. When DevTools is open, this pauses execution continuously, so the page appears frozen. Bypass: Disable breakpoints in DevTools (Ctrl+F8) or use the "Never pause here" context menu option. Total bypass time: 2 seconds.
The code overwrites console.log, console.warn, and console.error with empty functions to suppress output. That is ironic, given that the developer left 30+ debug statements that these overrides are designed to hide. Bypass: Store a reference to the original console methods before the page loads, or use the browser's native console API. Total bypass time: 5 seconds.
The combination of AI-generated code, debug statements in production, static XOR encryption, and trivially bypassable anti-analysis makes it clear that TRXDrop's operator is an unskilled developer: a scammer who bought a drainer kit and prompted an LLM to customize it. The danger here is accessibility. When the barrier to entry is "can you type a prompt," the number of operators grows exponentially.
This pattern is consistent across the drainer-as-a-service ecosystem. The kit developers (in this case, Angel Drainer) have genuine technical ability; the resellers and affiliates deploying these kits often do not. The anti-analysis layer is there only because the kit ships with it enabled by default.
All evidence referenced in this investigation is preserved in the PhishDestroy ScamIntelLogs repository. Each operation has its own directory containing configuration files, source code excerpts, domain lists, wallet addresses, and Telegram intelligence.
15 domains, source code, XOR keys, WalletConnect ID, operator Telegram, wallet address.
View on GitHub GitLabConfiguration files, affiliate payment records, multi-chain expansion plans, forum posts.
View on GitHub GitLabMember lists, wallet addresses, domain infrastructure, admin intelligence, disruption timeline.
View on GitHub GitLabAll wallet addresses, domain lists, and operator identifiers published in this report have been shared with relevant blockchain security teams and domain registrars prior to publication. The WalletConnect Project ID has been reported for revocation. If you operate infrastructure affected by these IOCs, contact us via @PhishDestroy_bot.
Drainer-as-a-service is scaling, and the barrier to entry is a Telegram message and a few hundred dollars. Your defense starts with awareness.
If a site forces repeated signing prompts, close it immediately. Legitimate airdrops never require unlimited token approvals.
Check domain age, verify through official project channels, and use a burner wallet for any airdrop claims.
Keep large holdings on hardware wallets. Never connect your primary wallet to unverified sites.
Found a drainer site? Report it to @PhishDestroy_bot or check domains at analyze.destroy.tools.
