How do cryptocurrency drainer phishing scams work?
Summary: Cryptodrainer phishing scams have grown more sophisticated, using social engineering to trick cryptocurrency holders into divulging private keys or login credentials, which are then swiftly drained from their wallets. Splunk researchers documented the campaign's pattern, including phishing sites such as hxxp[://]nfts-manta[.]network/ that prompt users to connect wallets via QR code, and noted a surge in campaigns spreading through compromised accounts on X (Twitter) and malicious Google Forms documents.
Why it matters: A single QR-code scan on a lookalike site hands over wallet credentials, and the source notes victims are often left with little recourse for recovery. The delivery channel is the harder problem: compromised social media accounts lend the fraudulent links an air of legitimacy that your users' judgment is not trained to catch.
Read the original at Cisco Talos ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026