backpackwallet[.]xyz

PhishDestroy identifies backpackwallet.xyz as a live crypto drainer targeting cryptocurrency wallet users through social engineering tactics designed to trick victims into connecting their wallets and approving malicious transactions. This domain mimics legitimate wallet services, particularly those with names suggesting portability or convenience, to deceive users into entering seed phrases or approving transactions that drain funds to attacker-controlled addresses. Threat actors leverage domain similarity and urgency-based lures to maximize successful compromises before security vendors catch up. This domain was flagged with a risk level marked as under_investigation and shows concerning technical indicators: VirusTotal currently detects 2 out of 95 security engines, indicating it has not yet been widely blacklisted despite active malicious activity. The domain was registered on April 11, 2026, through OwnRegistrar, Inc., and resolves to IP address 64.29.17.1 via a Let's Encrypt SSL certificate, which is commonly abused in short-lived malicious campaigns due to its ease of issuance and low verification requirements. The lack of early detection suggests this threat is in an early operational phase and may rapidly expand in scope before security controls catch up. Users who have visited backpackwallet.xyz should immediately disconnect their wallets, revoke any unintended transaction approvals, and transfer remaining assets to a clean wallet. Do not interact with this domain further and report the activity to your wallet provider and relevant threat intelligence platforms. Monitor wallet transaction histories and consider rotating seed phrases if credentials were exposed. Users should also block the domain at the network level and update browser-based security filters to include backpackwallet.xyz and its associated IP address 64.29.17.1. Security teams are advised to ingest this domain into blocklists and monitor for related infrastructure using the unique seed identifier 0704df for tracking.