Lucifer DaaS
Last changed 2026-10-27 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·55KRkj…97hmSummary
Lucifer DaaS (also referred to as Lucifer Drainer) is a criminal drainer-as-a-service platform active from at least January 2025, analyzed by Flare threat intelligence researchers across approximately 700 posts from underground forums and Telegram channels. It runs an affiliate commission model in which operators keep 20% of each successful drain and affiliates supplying phishing traffic keep 80%, and it has progressively professionalized its tooling with multichain wallet draining, Permit2 signature abuse, automated phishing-site deployment and site cloning. Despite Telegram bot bans in August 2025 and a documentation-domain suspension in November 2025, it migrated to IPFS and remained active and recruiting as of May 2026; no operator identities, attributable wallet addresses or law enforcement actions have been publicly reported.
Connected Entities
6 entities · 60 linked investigations- wallet drainers→mentioned with→Ethereum(70%)
- Uniswap→mentioned with→Ethereum(80%)
- Inferno Drainer→mentioned with→Ethereum(70%)
- Lucifer DaaS→mentioned with→wallet drainers(80%)
- Lucifer Drainer→mentioned with→Inferno Drainer(80%)
- Lucifer Drainer→mentioned with→Lucifer DaaS(80%)
- Lucifer DaaS→mentioned with→Lucifer Drainer(80%)
- Lucifer DaaS→mentioned with→Inferno Drainer(80%)
- wallet drainers→mentioned with→Inferno Drainer(80%)
- Lucifer DaaS→mentioned with→Ethereum(80%)
- + 2 more
Timeline(10 events)
November 2023
Inferno Drainer announces shutdown after claiming over $80 million in total theft; it was later found to have continued operating covertly.
Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNewsMay 2024
Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.
Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCryptoJuly 2024
Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.
Angel Drainer App Shuts Down After Developer Identification — CryptoTimesOctober 2024
Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team.
Angel Drainer Absorbs Inferno's Toolkit — CryptoRank2025
Start of the period covered by Flare's analysis: approximately 700 Lucifer DaaS posts from underground forums, chats and Telegram channels collected between January 2025 and early 2026.
Inside a Crypto Drainer — BleepingComputer (Flare research)March 2025
Lucifer operators announce version 6.6.6, introducing ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses and multichain functionality; the announcement reiterates the software is not for sale and the 20% operator commission.
Inside a Crypto Drainer — BleepingComputer (Flare research)May 2025
Lucifer channel posts restate the commission-only model: the operation does not sell or lease the software and only splits '20% per hit'; affiliate recruitment continues.
Inside a Crypto Drainer — BleepingComputer (Flare research)August 2025
Telegram bans Lucifer DaaS bots. Operators instruct affiliates to create new bots and grant them administrative privileges, restoring operations without extended downtime.
Inside a Crypto Drainer — BleepingComputer (Flare research)November 2025
Lucifer's documentation domain hosted on Google Firebase is suspended, reportedly following security research disclosures; operators migrate documentation to IPFS, citing decentralization as takedown resistance.
Inside a Crypto Drainer — BleepingComputer (Flare research)May 2026
BleepingComputer publishes Flare's analysis of Lucifer DaaS, the first detailed public research into its internal structure, business model and technical evolution, reporting the platform still live and recruiting affiliates.
Inside a Crypto Drainer — BleepingComputer (Flare research)Decision Log
- slot 461974673 · hash LHAAP9mgcdC9KYU8PEGiRndZvKvUyozJu1VhvtiHbmw
- slot 461974668 · hash 2RZEjrqVdcajqPVLrABtju1FptqqspzaiTMdawheEizM
- slot 457443793 · hash 4DuzpfV16CSvYGXJooeyG49vjjCyk7RszxmgDcdX1Zd8
- slot 443519843 · hash Bzg96hm5Pw2UfYCXoynGi65PpqCSLVc3EmTH63FRHCpv
- slot 443519838 · hash J5c5CkEuPG8WetKx2B8Efg8CVHVETdZqvhv37bWhv6SC
- slot 443504252 · hash HAuxVgEQwWdKPgSu3yJ2aiTxAfjnSHq7iYWGZw5FE5Lo
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 20 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/4/2026, 11:36:21 PM
last updated: 10/27/2026, 6:48:25 AM
12 viewsavoid.net — verified advice for a post-truth world