NameSilo Defended a $100M Crypto Drainer
— Then Had to Defend Itself

The NewAlchemy audit earned 67 Reddit upvotes and was used as a trust signal for years. Its explicit scope: "client-side JavaScript only." Explicitly out of scope: "numerous PHP API endpoints." Those endpoints are the actual theft mechanism. The audit was structurally incapable of finding the backdoor.

January 21, 2026 — xmrwallet paid PR Newswire to distribute a press release stating: "private keys never reach central servers." The session_key POST requests were firing on every user session to the production server throughout this period. PR Newswire is a paid distribution service — companies write and fund their own text, with no editorial review. Source: PR Newswire, Jan 21, 2026

Both manipulate reviews: xmrwallet removes theft complaints and answers victims with the same synchronization excuse; NameSilo floods Trustpilot with scripted five-star praise for named support agents while negative reviews disappear.

Both run the same SEO defense: xmrwallet publishes “scam,” “security,” “recovery” and “sync” articles; NameSilo publishes “phishing,” “blacklist,” “delisting” and “abuse” articles. Both fill the exact searches created by the accusations against them with their own text.

Both use the same paid-article resource: PR Newswire distribution and the email4pr relay. NameSilo uses it for Canadian-market investor releases. xmrwallet used it to sell a false Tor and “keys never reach the server” story as corporate-looking news.

Two names. The same review manipulation. The same SEO. The same paid PR pipeline. One brain.

The January 2026 release announced “full Tor integration” for an “open-source” project whose last real GitHub commit was November 6, 2018 — more than seven years earlier. No Tor code was ever committed. They paid to advertise a feature that did not exist in the public codebase while also claiming that private keys never reached a central server. The release used an invalid phone number and an enterprise PR relay address. This was not independent coverage. It was operator-written copy purchased for distribution.

Archived release and contact details · Public GitHub repository

This is the part the separate incidents hide. The client was already gone. What continued was NameSilo’s defense of NameSilo.

PR Newswire charges approximately $195–249 per year for membership plus $805–3,000+ for each release. Free or far cheaper alternatives exist, including PRLog and EIN Presswire at roughly $149. Yet a volunteer wallet with zero disclosed donations chose the same enterprise distribution pipeline that NameSilo Technologies uses for Canadian Securities Exchange communications.

xmrwallet published three releases through this pipeline, including its January 21, 2026 Tor announcement. NameSilo published 12 releases: “Surpasses 6 Million Domains” on January 22, 2026—one day after xmrwallet, its 2025 year-end results on May 1, 2026, and ten more releases covering quarterly results, SewerVUE, CommerceHQ, Reach Systems and a subsidiary sale. SewerVUE is literally a sewer-pipe inspection company—that is why our “old friend cleaning sewer pipes” reference was not random.

The SEO articles and the support reviews solve the same reputation problem from two directions. NameSilo fills negative searches—phishing, abuse, blacklist, delisting, stolen domain—with its own explanations. At the same time, the review stream fills the support question with praise for “Leonid” and other named agents.

A real customer receives a rude, unclear or scripted answer, then sees page after page saying Leonid is brilliant and helpful. The intended effect is doubt: “If everybody praises this support, perhaps the problem is me.” The customer hesitates and decides not to publish the truthful negative review. If they publish it anyway, our observed pattern is that NameSilo challenges or reports it until it disappears. The positive reviews do not merely improve a score; they suppress the next negative review before it exists, while removals erase the ones that still get written.

That is the shared mechanism: capture the negative words in search, manufacture the positive answer in reviews, and remove the testimony that contradicts both.

Our 2023–2024 database contains tens of thousands of abuse reports associated with NameSilo that, in our assessment, were ignored or produced no effective action. In the drainer slice we were tracking at the time, effectively every operation was registering domains there. On that dataset, we considered NameSilo the worst-performing registrar. We will publish the complete registrar comparison separately.

Our opinion: the repeated phishing, blacklist, delisting and abuse articles were not written because ICANN required them. They were written to occupy the searches generated by NameSilo’s real abuse record.

From our first message, we warned both xmrwallet and NameSilo not to turn a technical report into a pressure campaign. Both responded with threats involving litigation and private investigators. The xmrwallet operator even suggested bringing the registrar into court. NameSilo later threatened legal action publicly after offering to remove VirusTotal detections for the same client.

Perhaps this approach worked for ten years. It does not make the underlying evidence disappear.

xmrwallet was already closed. The later Twitter lock, GDPR requests, DMCA notices, complaints against individual search results, phishing reports against our own site, Bing deindexation and attempted IPFS takedowns could no longer protect the wallet. They could protect only NameSilo’s reputation.

The requests did not target only our domain. They targeted individual links leading to our work. The public Lumen Database trail records part of this campaign; additional records are preserved in our Telegram archive.

We also believe that, with a larger media budget, the next predictable step would be purchased coverage portraying the researcher as a stalker or extortionist. That is a forecast based on the suppression pattern, not an event we claim has already occurred.

This was not one complaint against one page. The campaign targeted our domain and the individual search results linking to our work—one URL after another—using GDPR, DMCA, phishing reports and platform complaints. The objective was to make the investigation disappear from the search journey even when the underlying archive remained online.

The timing answers the motive question: xmrwallet was already closed. A closed wallet could no longer benefit from this attack. The remaining beneficiary was NameSilo, whose name, abuse history and defense of the wallet were attached to those results.

So who else in this story repeatedly manipulates discovery around exact names and exact negative queries—through first-party SEO pages, paid distribution and, in our assessment, Google Ads around specific terms? NameSilo. The same logic appears again: capture the name, replace the result, and suppress the link that cannot be rewritten.

While they were rewriting the same SEO articles, buying corporate-looking announcements, manufacturing support praise and trying to erase our links, the operation they protected was closed. It was not closed by the victim they misled, a famous investigator or a commercial security company. We closed it—a noncommercial research project working for zero dollars.

The later suppression campaign makes the contrast worse. Corporate accounts, legal complaints, deindexing requests and takedown attempts were aimed at researchers with no paid media budget. They still could not remove the archives, reverse the evidence or reopen the wallet. Every attempt simply created another timestamp and another exhibit at no cost to us.

That is not operational strength. It is strategic incompetence. They had money, infrastructure and platform access. We had evidence, public archives and $0—and the scam is the thing that disappeared.

One logic, one strategy: manufacture reviews, occupy the accusation in search, purchase corporate-looking coverage, remove detections, move the defended domain, threaten the researchers and then suppress every path leading to their evidence. The client disappeared. The strategy continued because its second phase was the defense of NameSilo itself.

IP clustering: 185.129.100.248 shared by .cc and .me — same host. 190.115.31.40 shared by .biz and .net — same host. Four registrars, two IP clusters. 33 years of prepaid registration. All registered in secret after first contact with investigators.

One 5-star for NameSilo (Jan 2026): “Leonid was very helpful… 5 stars!” The other review: for Otrium — a company with reviews alleging fraud and stolen money. One bot account, two scam-adjacent businesses. Pattern: named support agents, praised response time, templated language. Real domain buyers review prices and panel UX. Bot reviews praise “Leonid.”

Leonid appeared on April 13, 2025. Zero mentions before. Then 65 reviews in his first two months. May 2025: 106 reviews (5× normal), 95% five-star, zero one-star. Not one unhappy customer in 106 reviews for a registrar ranked #96 in .com pricing.

43% of Leonid reviews are under 80 characters. Four have the title just “Leonid”. Three more: “Leonid was very helpful.” Among reviewers: “Satoshi Nakamoto,” “Author,” “Виктор -”, “Anna Koroleva,” “Boris Martin,” “Andrei Dobrescu” mixed with “Brad,” “LaToya,” “Patty Johnson.” A name generator cycling through continents. The name Leonid is Russian.

“Company A exhibits extensive, multi-dimensional evidence of systematic review manipulation through coordinated artificial generation. The probability of these patterns occurring organically approaches zero.”

Full analysis: phishdestroy.eth.limo/namesilo-trustpilot.html · Raw data: trustpilot-forensic-report-final.txt

xmrwallet.com transferred to Namecheap in May 2026, registered until 2036. NameSilo apparently considers this resolved. It is not.

You thought the experts who could outperform every antivirus vendor would stop when the domain moved? The investigation is on IPFS. It is on Arweave. It is in ICANN's formal complaint system. It is with EU law enforcement. It is with 3 national cybercrime units. The legal threat added one more timestamp to the file. The domain transfer added one more exhibit. Every action taken to suppress this investigation is itself documented evidence of the pattern we described.

You were not the smartest people in this situation. You just had more money for a while.