sol-kit[.]top

This domain, sol-kit.top, is actively distributing a crypto drainer designed to siphon digital assets from connected wallets. The site masquerades as a legitimate CODE COMPILER interface, tricking users into executing malicious scripts that initiate unauthorized transactions. Analysis indicates the threat specifically targets cryptocurrency holders by exploiting browser-based wallet integrations, with payloads likely embedded in obfuscated JavaScript or WebAssembly modules. The attack vector aligns with known drainer kits that manipulate transaction confirmations or inject fake approval prompts to bypass user consent. Infrastructure analysis reveals the domain was registered on June 03, 2026, through NameSilo, LLC, an uncommon choice for legitimate development tools. Security telemetry shows 4 out of 95 vendors on VirusTotal flag the domain as malicious, while it appears on 3 independent blocklists. The discrepancy between low vendor detection (4.2%) and high-risk classification suggests the campaign employs evasion techniques such as domain shadowing, fast-flux DNS, or polymorphic payloads. The page title 'CODE COMPILER' further corroborates the impersonation tactic, as no legitimate compiler tools use this exact phrasing in their metadata. Users who interacted with sol-kit.top should immediately revoke all active wallet approvals via their blockchain explorer's token permissions interface. Disconnect any linked browser extensions or dApps, then scan the system for unauthorized processes using endpoint detection tools. Reset all stored credentials in the affected browser, as drainers often harvest session cookies or local storage artifacts. Monitor wallet addresses for unexpected token transfers, particularly ERC-20 or NFT approvals, and report the incident to relevant blockchain security platforms. The domain remains active as of this advisory, with no takedown requests observed in public threat feeds.