Why new EVM chains become drainer magnets before launch

At a glance

What this is: Blockaid maps how new blockchain launches attract drainer-as-a-service operations, with EVM-compatible chains facing the fastest and most consistent criminal attention.

Why it matters: This matters because the attack conditions are visible before launch, so wallet, exchange, and chain teams need transaction-level protection and pre-launch monitoring rather than reactive alerts.

Context

New blockchain launches create a predictable security problem: high user attention, unfamiliar interfaces, and urgent token activity combine into a fraud-friendly environment. In practice, that makes wallet users the immediate target, while the chain itself becomes the event that concentrates risk. The issue is not limited to one ecosystem; it is a launch pattern that can be observed before the first mainnet transaction.

Blockaid’s analysis focuses on how criminal operators respond to that pattern across new chains. The key governance question is whether security teams can recognise the launch window as an attack surface in its own right, especially where users are connecting wallets to new dApps and signing transactions under time pressure.

Key questions

Q: What breaks when new blockchain launches are treated as normal product releases?

A: Launches become a fraud window instead of a routine release if teams do not model wallet connection, token hype, and impersonation infrastructure as active attack conditions. Criminal operators can pre-position malicious dApps, copy launch branding, and harvest approvals before defenders react. The failure is assuming risk starts after mainnet, when it often starts before it.

Q: Why do EVM-compatible chains attract more drainer activity than non-EVM chains?

A: EVM compatibility lowers attacker setup cost because existing draining kits already understand ERC-20 approvals, permit flows, and common router interactions. A new EVM chain can often be added by changing chain ID and RPC details, while non-EVM support usually needs bespoke engineering. That makes EVM launches faster to operationalise for criminals.

Q: What are the signs that a launch is becoming a wallet-draining target?

A: Watch for fake dApps, cloned token pages, impersonation domains, and launch-themed phishing assets appearing before or during mainnet. A rapid rise in malicious pages, especially around airdrop speculation or token generation events, usually means attackers are following the same user attention that the project is trying to create. Those are the early operational signals.

Q: How should teams respond when a launch event creates speculative wallet activity?

A: Treat the event as a transaction-risk problem, not only a communications problem. Security teams should align launch timing with wallet screening, impersonation monitoring, and analyst coverage of approval prompts. The goal is to reduce the chance that users will sign malicious transactions simply because the ecosystem feels urgent and familiar.

Technical breakdown

How drainer-as-a-service scales around new chain launches

Drainer-as-a-service is a criminal operating model that separates kit development from distribution. Developers maintain malicious code, phishing pages, and backend infrastructure, while affiliates deploy the lures and drive victims to them. That division of labour matters because it turns a new chain launch into a repeatable campaign template rather than a bespoke attack. Once one operator has support for a chain, others can copy the same wallet-draining flow with minimal effort. The result is not just more scams, but faster replication across multiple operators watching the same launch signals. Practical implication: security teams should treat launch week as an active fraud escalation period, not a novelty event. See the Crypto Scam and Drainer Guide.

Practical implication: Treat launch windows as live fraud risk periods and monitor for copied dApps, token clones, and approval phishing from day one.

Why EVM compatibility shortens the attacker’s setup time

EVM compatibility lowers the cost of malicious adaptation because the attacker can reuse existing tooling for ERC-20 approvals, permit signatures, multicall interactions, and DEX router flows. Instead of building a new transaction stack, an operator usually only needs a new RPC endpoint and chain ID. That means a fresh EVM chain can be added to criminal infrastructure almost immediately, while non-EVM chains require materially more custom engineering. The important security point is that compatibility is not a vulnerability by itself, but it does remove friction for commodity attackers. Practical implication: launch teams should assume EVM compatibility increases their exposure to fast-follow phishing and drainer campaigns.

Practical implication: Assume EVM compatibility lowers attacker friction and prioritise pre-launch scam detection accordingly.

How hype and token events convert attention into compromise

The launch itself is only part of the risk. Hype, airdrop speculation, and token generation events create the user behaviour drainers depend on, especially when people rush to connect wallets, claim rewards, or sign unfamiliar approvals. That behavioural pressure is what turns a technically ordinary chain into a high-yield target. Two EVM chains can have similar technical profiles and still produce very different criminal outcomes if one has strong token narratives and the other is launched quietly. This is why the problem is as much about attention engineering as about blockchain architecture. Practical implication: teams should map marketing and token events to security readiness, not treat them as separate workstreams. Read the Ultimate Guide to NHIs: Static vs Dynamic Secrets.

Practical implication: Align launch comms, token events, and security monitoring so speculative user behaviour is covered before it starts.

Threat narrative

Attacker objective: The attacker wants to convert launch hype into fast wallet approvals, then drain assets before the campaign loses novelty.

1. Entry occurs when users are lured to malicious dApps, fake tokens, or launch-themed phishing infrastructure built around a new chain.
2. Credential_harvested happens when victims sign approvals or transaction payloads that authorise asset transfer or draining.
3. Escalation follows as the same infrastructure is reused across affiliates and copied into wider launch campaigns, expanding reach across multiple chains.
4. Impact is wallet draining and asset theft at scale during the launch window, often before users or defenders recognise the malicious infrastructure.

Breaches seen in the wild

• Lottie Player npm compromise 2024: A compromised developer npm token let attackers publish three Lottie Player versions that pushed a crypto wallet drainer to websites.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Launch timing is now part of the threat model. The article shows that criminal infrastructure often appears before a chain is live, which means governance cannot wait for post-launch telemetry. For identity and access practitioners, the lesson is that user intent is being targeted at the moment of wallet connection, not after compromise is complete. That shifts defence from after-the-fact detection to pre-launch risk anticipation.

Attention, not just technical novelty, determines exploitability. The strongest criminal response followed chains with airdrop narratives, speculative communities, and heavy onboarding pressure. This is a classic trust-exploitation pattern: users are induced to approve unfamiliar actions because the reward looks time-sensitive. In practice, the launch process itself becomes a fraud control problem, not just a blockchain operations problem.

EVM monoculture creates a reusable criminal playbook. Because attackers can reuse approvals, routers, and transaction patterns across chains, each new EVM launch inherits a pre-existing adversary toolkit. That makes the security issue less about chain uniqueness and more about how quickly malicious support can be copied across ecosystems. Teams should view EVM launch risk as a repeatable governance pattern, not a one-off event.

Threat intelligence must be tied to the user decision point. The article’s core finding is that post-hoc monitoring is too late when the malicious dApp or token is already in front of the user. For a real defence model, the relevant control point is the moment of connection or signing, which is why wallet-level screening belongs alongside launch communications and ecosystem monitoring.

Wallet approval trust gap: launch hype collapses the gap between user curiosity and adversary execution, leaving approval-based theft as the default attack path. That gap matters because the user sees a legitimate-looking ecosystem event while the attacker sees a reusable extraction workflow. Practitioners should treat launch-driven approval risk as a standing governance concern, not a seasonal anomaly.

Read next: Crypto Scam and Drainer Guide

What this signals

Launch-driven fraud is becoming a repeatable security pattern. The practical lesson for teams is that chain launches now need the same pre-event scrutiny that high-value financial launches get, because adversaries watch the same calendar and exploit the same user momentum. The controls that matter most are those that intervene before a wallet approval is signed, not after a drain is visible.

Wallet approval trust gap: the core problem is that users often cannot distinguish a legitimate launch from a malicious clone at the point of interaction. That means launch communications, fraud monitoring, and transaction screening have to be coordinated as one operational control surface, especially when airdrop narratives create urgency.

For practitioners

• Pre-stage launch monitoring before mainnet Set monitoring in place before announcement windows, not after launch-day activity begins, and watch for cloned dApps, fake tokens, and approval-phishing pages.
• Tie token events to security readiness Map airdrops, token generation events, and onboarding surges to security sign-off so speculative user behaviour is covered before wallet connection spikes.
• Screen dApps and transactions at the wallet boundary Inspect the site, token, and transaction context at the point of signing so malicious infrastructure is warned on before approval executes.
• Hunt for launch-themed impersonation infrastructure Track newly registered domains, certificate transparency entries, and impersonation templates that mirror the naming and branding of upcoming chains.
• Use chain launch intel in fraud operations Feed launch dates, token narratives, and public-sale milestones into fraud and security workflows so the highest-risk periods are obvious to analysts and wallet teams.

Key takeaways

• New chain launches are not just product events, they are predictable fraud windows when wallet approval abuse becomes easier to scale.
• EVM compatibility lowers the cost of malicious adaptation, which helps explain why drainer operators move so quickly into those ecosystems.
• The most effective defence is to shift protection to the point of user intent, before a malicious connection or signing action can execute.

Related NHI Mgmt Group resources: Crypto Scam and Drainer Guide · Ultimate Guide to NHIs: Static vs Dynamic Secrets

Key terms

• Drainer-as-a-Service: Drainer-as-a-Service is a commoditised criminal model where phishing kits, smart contracts, and infrastructure are sold or shared for a cut of stolen funds. It lowers attacker skill requirements and turns wallet abuse into a repeatable campaign model with predictable operational components.
• Wallet Approval: A wallet approval is a permission a user grants to a smart contract or site to spend tokens or act on their behalf. These approvals can persist after the original interaction and become a theft path if granted to a malicious application. Security review must include revocation and monitoring, not just initial login checks.
• EVM Compatibility: The ability of a blockchain to support Ethereum Virtual Machine transaction logic, tooling, and contract patterns. For defenders, this matters because it lets attackers reuse existing approval and draining techniques with only minor configuration changes, which reduces the cost of abuse.
• Launch-Window Fraud: Fraud activity that concentrates around a new product or chain launch when user attention is high and security judgement is weaker. In blockchain environments, it often combines impersonation, speculative hype, and rushed wallet actions to convert excitement into theft.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management in a way that helps practitioners connect identity control to broader security operations. It is suitable for teams that need a stronger governance lens across fast-moving digital environments.