Lucifer Drainer
Summary
Lucifer Drainer is a criminal drainer-as-a-service (DaaS) platform that industrializes cryptocurrency wallet theft through a structured affiliate model. Active since at least early 2025, it operates by providing affiliates with phishing kits, automated site-cloning tools, and commission-split infrastructure (operators retain 20% per successful drain) while affiliates supply phishing traffic. Despite Telegram bot bans in August 2025 and documentation domain suspension in November 2025, the operation migrated to IPFS and remained active as of May 2026, making it one of the most operationally resilient drainer platforms in the current threat landscape.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2023-11-01
Inferno Drainer announces shutdown after claiming over $80 million in total theft; later found to have continued operations covertly.
Inferno Drainer Shuts Down After Heist of Over $80M — CryptoNews2024-05-17
Pink Drainer ceases operations after stealing approximately $85 million from over 21,000 victims.
Pink Drainer Shuts Down After Stealing $85 Million in Crypto — BeInCrypto2024-07-17
Angel Drainer suspends operations after cybersecurity firm Match Systems claims to have de-anonymized its developers.
Angel Drainer App Shuts Down After Developer Identification — CryptoTimes2024-10-19
Inferno Drainer announces it has transferred its platform and code to the Angel Drainer team, consolidating two of the largest DaaS operations.
Angel Drainer Absorbs Inferno's Toolkit — CryptoRank2025-01-01
Flare researchers begin collecting and analyzing approximately 700 underground posts from forums, chats, and channels related to Lucifer DaaS; research period spans January 2025 through early 2026.
Inside a Crypto Drainer — Bleeping Computer2025-03-01
Lucifer Drainer announces version 6.6.6 featuring ERC-20 support, Permit2 abuse, off-chain signatures, Telegram notifications, wallet-security bypasses, and multichain deployment.
Inside a Crypto Drainer — Bleeping Computer2025-05-01
Lucifer Drainer operators publicly restate the commission-only model: 'We do not sell or lease the software and only split 20% per hit.'
Inside a Crypto Drainer — Bleeping Computer2025-08-01
Telegram bans Lucifer Drainer bots. Operators instruct affiliates via channel to create new bots and grant them admin privileges, maintaining continuity.
Inside a Crypto Drainer — Bleeping Computer2025-11-01
Documentation domain hosted on Google Firebase suspended following security research exposure. Lucifer Drainer migrates documentation to IPFS, citing decentralization as a takedown-resistance strategy.
Inside a Crypto Drainer — Bleeping Computer2026-05-21
Bleeping Computer publishes deep-dive on Lucifer Drainer's internal operations, confirming the platform remains live and actively recruiting affiliates as of May 2026.
Inside a Crypto Drainer — Bleeping ComputerDecision Log
- hash: A2KzH6E72y9nrnRBjgXZnaFsLYSVYBaBw9hhaYZfZQNv
- hash: 6YsRZr5w783MdbtJUr3WiPpteHUTMv4Y51QrGrqpmdDq
- hash: 6BShEfFLnWs1sLy4SgCowvRjPca3Uanx3FWj7GskbKQC
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/2/2026, 8:04:13 PM
last updated: 6/3/2026, 3:33:59 AM
avoid.net — verified advice for a post-truth world