defi-llama-v2[.]xyz

The domain defi-llama-v2.xyz was a crypto drainer phishing site designed to steal cryptocurrency from victims by draining wallet funds. It did not impersonate a specific legitimate brand but operated as a standalone scam targeting users in the decentralized finance (DeFi) space. As of the latest verification, defi-llama-v2.xyz has been taken offline, though its prior activity poses residual risks to users who may have interacted with it.

Technical analysis of defi-llama-v2.xyz revealed limited detection, with 2 of 95 VirusTotal security vendors flagging the domain, including alphaMountain.ai and Forcepoint ThreatSeeker. The domain appeared on 1 security blocklist, specifically PhishDestroy. It was created on February 21, 2026, though registrar, IP address, and SSL issuer details were not available. The observed page title was 'www.www.defi-llama-v2.xyz', and Gridinsoft assigned it a trust score of 0 out of 100, further indicating its malicious nature.

Users who may have connected wallets to defi-llama-v2.xyz should immediately revoke all token approvals using a tool like Revoke.cash or Etherscan's token approval checker. Funds should be transferred to a new, secure wallet to prevent further unauthorized access. Victims are advised to monitor their wallets for suspicious transactions and report the domain to platforms like Google Safe Browsing, PhishTank, or their local cybercrime authorities to aid in broader threat mitigation.