Drainer-as-a-Service (DaaS) is a criminal business model where developers build and sell wallet-draining toolkits to less technical scammers for a revenue share (typically 20-30% of stolen funds). The buyer sets up phishing sites, the toolkit handles the technical exploitation: crafting malicious approvals, detecting wallet balances across chains, prioritizing high-value assets, and sweeping everything in one transaction. It has industrialized crypto theft.
What Is a Drainer-as-a-Service?
4 min read
The short version
Crypto theft used to require a skilled hacker. Now it requires a credit card. DaaS operators sell turnkey phishing kits on Telegram: you pay $200-$500 for the software, set up a fake website mimicking a popular project, promote it on Twitter, and the drainer toolkit does the rest. The developer takes 20-30% of whatever you steal. It turned a niche crime into a franchise operation.
How It Works
How the DaaS ecosystem works: The developer: builds the drainer smart contract and frontend toolkit. They maintain it (updating to bypass new wallet security features), host the backend infrastructure, and provide customer support to buyers. They earn 20-30% of all funds drained by anyone using their toolkit. The buyer (phisher): purchases or rents access to the toolkit. They create phishing websites (cloned DeFi interfaces, fake NFT mints, fake airdrop claims). They promote these via: compromised Twitter accounts, Google Ads for crypto keywords, Discord DMs, and Telegram groups. When a victim connects their wallet and signs the malicious transaction, the drainer fires. The drainer toolkit capabilities: (1) Detects all tokens, NFTs, and native currency across multiple chains in the victim wallet. (2) Prioritizes by value (drains highest-value assets first). (3) Crafts optimal approval or transfer transactions (setApprovalForAll for NFTs, unlimited approve for ERC-20s, or direct transfer for native tokens). (4) Bundles multiple drains into as few transactions as possible. (5) Splits stolen funds: 70-80% to the phisher, 20-30% to the DaaS developer (automatic smart contract split). Major DaaS operations (exposed/shutdown): Inferno Drainer (shut down November 2023 after draining $80M+), Pink Drainer (shut down May 2024 after $75M+), Angel Drainer, and others that continue operating. Scale: in 2023, DaaS-powered phishing drained an estimated $300M+ from crypto users.
How a DaaS attack unfolds in real time
A scammer buys access to a DaaS toolkit for $300 on Telegram. They clone the Uniswap interface at uniswop-claim.com (one letter different). They buy Google Ads targeting Uniswap airdrop for $50. A victim searches for Uniswap, clicks the ad, lands on the fake site. The site says: Claim your UNI airdrop! Connect wallet to verify eligibility. The victim connects MetaMask. The drainer scans their wallet: finds 2.3 ETH, 5,000 USDC, 3 NFTs worth 1.2 ETH. The site shows: Sign to verify your wallet. The victim signs what looks like a message but is actually a Permit2 signature granting the drainer contract unlimited access to all their ERC-20 tokens. Within 3 seconds: USDC transferred out, ETH transferred out, NFTs transferred out. Total drained: ~$12,000. Split: scammer gets $8,400, DaaS developer gets $3,600 (automatic). The victim sees empty wallet within minutes. Transaction is irreversible.
What People Get Wrong
Only sophisticated hackers can drain wallets
DaaS removed the technical barrier entirely. A person with zero coding knowledge can drain wallets using these toolkits. The phishing/marketing is the only skill required. This is why drainer attacks have scaled so dramatically since 2022: the tools are available to anyone willing to pay for them.
Drainers can only steal if you share your seed phrase
Modern drainers do NOT need your seed phrase. They trick you into signing malicious approvals or Permit2 signatures that give the drainer contract permission to move your tokens. Your seed stays private. Your funds still disappear. The attack vector is a signed transaction, not key compromise.
If a transaction looks like a message signature, it is safe
Permit2 and EIP-712 signatures look like message signing in your wallet popup but grant real token spending permissions. A malicious Sign popup can authorize the drainer to move all your USDC without a separate approve transaction. Always read what you are signing. If it mentions token amounts or spender addresses, it is not just a message.
Keep Reading
Sources & Further Reading
- Revoke.cash
Check and revoke any approvals that DaaS drainers might exploit
- Pocket Universe
Transaction simulator that warns before you sign drainer transactions
- ScamSniffer
Tracks DaaS operations, phishing sites, and stolen fund flows in real time
Questions People Also Ask
- How do I protect myself from DaaS attacks?
- Four habits: (1) Never click Google Ads for crypto projects (type URLs directly or use bookmarks). (2) Use transaction simulation (Pocket Universe, Rabby) that shows what a signature will actually do before you sign. (3) Set limited approvals (never unlimited). (4) If a site asks you to sign anything to claim, verify, or connect: close it and go to the official project URL independently.
- Are DaaS operators prosecuted?
- Increasingly yes. In 2024, law enforcement identified operators of Inferno Drainer and several others. However, most operate from jurisdictions with weak enforcement, use pseudonymous communication, and receive funds through mixers. Prosecution is slow relative to the speed of new operations launching. Prevention is more effective than relying on law enforcement.
- How much money is stolen through DaaS annually?
- Estimates for 2023: $300M+ stolen via DaaS-powered phishing (per ScamSniffer data). In Q1 2024 alone: $104M drained. The figure is growing year-over-year as tools become more sophisticated and accessible. It is the largest source of individual crypto theft by dollar volume.