Vanilla Drainer Evades Detection, Siphons $5M in Weeks

A new cryptocurrency scam service known as Vanilla Drainer has been implicated in the theft of approximately $5.27 million in three weeks, according to blockchain investigations. The service operates by supplying fraudsters with phishing software and other tools to siphon victims’ crypto assets. These operations are often paired with phishing tactics that allow scammers to access private keys or seed phrases, enabling them to drain victim accounts [1].

According to investigators, Vanilla Drainer is part of a new wave of scam services that have emerged as traditional drainers, such as Inferno Drainer, have seen their activities decline due to improved detection tools and increased regulatory scrutiny. However, Vanilla has rapidly gained traction, with some suggesting it is absorbing the customer base of older drainers. One investigator, Darkbit, noted that the service appears to be responsible for the majority of recent large-scale thefts, particularly those in the six- and seven-figure range [1].

Vanilla Drainer is believed to have begun operations as early as October 2024, with its first known public advertisement posted on December 8, 2024. The ad claimed the service could bypass Blockaid, a fraud detection platform known for identifying and flagging suspicious transactions. This suggests that Vanilla has been designed with evasion tactics in mind, allowing it to operate with a lower chance of detection compared to its predecessors [1].

The service’s fee structure is standard for drainer operations, with the drainer taking a 15%-20% cut of stolen funds, according to available data. For particularly large hauls, the commission rate appears to decrease slightly. The largest known theft attributed to Vanilla occurred on August 5, when a victim lost $3.09 million in stablecoins. In that case, Vanilla’s operators received a $463,000 commission, equivalent to about 17% of the stolen amount [1].

After receiving its cut, Vanilla typically converts the stolen tokens into a blockchain’s native cryptocurrency—such as Ether (ETH)—before transferring the funds to a final fee wallet. This wallet, identified as 0x9d3…E710d, has accumulated over $2.23 million in tokens, primarily in DAI and ETH. DAI is a decentralized stablecoin pegged to the U.S. dollar and is preferred by scammers due to its resistance to freezing by centralized entities, unlike USDt or USDC [1].

Despite the apparent success of Vanilla Drainer, investigators have observed the group employing tactics to avoid detection, including rapidly cycling through domains and creating new blockchain contracts for each malicious site. These strategies help the service remain under the radar and evade tracking by blockchain analysts. In recent months, phishing scams have surged, with July alone seeing a 153% increase in total funds stolen compared to June. Vanilla’s involvement in a portion of these scams further underscores its growing influence in the crypto crime landscape [1].

The persistence of drainer services like Vanilla highlights the ongoing challenges in combating cryptocurrency fraud. While some operations have announced closures—such as Inferno Drainer, which shut down in November 2023—such moves rarely mark the end of the group’s activities. Instead, these entities often rebrand or transfer their tools to new operators, continuing their operations under different names. This trend is reflected in the continued attribution of scams to services that have claimed to discontinue their activities, indicating that the drainer ecosystem remains resilient despite increased scrutiny [1].

Source: [1] New scam service Vanilla Drainer takes $5M in three weeks (https://cointelegraph.com/news/new-scam-service-vanilla-drainer-5m-three-weeks) [2] New scam service Vanilla Drainer bilked over $5 million in ... (https://www.mexc.com/news/new-scam-service-vanilla-drainer-bilked-over-5-million-in-three-weeks/73234)