X is becoming a primary delivery channel for crypto drainers

At a glance

What this is: Blockaid describes how crypto drainer operators are using X account credibility, algorithmic amplification and disguised dApps to push wallet theft at scale.

Why it matters: It matters because identity signals, social proof and platform trust are being weaponised before any wallet connection occurs, so practitioners need controls that evaluate the lure as well as the transaction.

By the numbers:

• Blockaid scanned over 2.4 billion transactions in 2024 and blocked 71 million attacks.
• Blockaid detected 20 different X accounts sharing malicious AngelFerno dApps between September 2025 and January 2026.
• Blockaid detected more than 260 distinct URLs of Rublevka-associated dApps shared as part of the campaign.

Context

Crypto drainers are a social engineering and wallet-theft problem, not just a malware problem. They rely on trust signals, urgency and transaction signing to move value out of user wallets before the victim understands what happened.

In this case, the governance gap is the weak boundary between platform trust and transaction trust: a convincing social post can now become the entry point for wallet compromise. That makes the problem relevant to identity security, because account credibility, verification and behavioural signals are being used as attack infrastructure.

Key questions

Q: What breaks when crypto drainers use trusted social accounts to distribute malicious dApps?

A: The control that breaks is the assumption that a credible-looking account is a safe source of links. Aged profiles, verification and high follower counts can all be manufactured or abused, so teams need to validate the destination and the transaction context separately from the posting account. Without that separation, trust signals become attack infrastructure.

Q: Why do social proof and verification badges increase crypto drainer success?

A: They reduce the friction that normally makes users pause before clicking or signing. When a post appears to come from a familiar or verified account, users are more likely to treat the request as routine and move quickly to wallet connection. That makes reputation signals part of the threat model, not just a branding issue.

Q: How can teams reduce wallet-drainer risk from social media campaigns?

A: Combine content monitoring, URL reputation, domain similarity checks and transaction-risk scoring so suspicious links can be blocked before a wallet is connected. The goal is to interrupt the path from post to signing, because once the user approves the transaction, the attacker has already converted social trust into financial loss.

Q: What should organisations do when a crypto scam uses both legitimate reposts and malicious links?

A: Treat the campaign as coordinated abuse rather than isolated spam. Preserve the URLs, account handles and repost relationships, then feed them into detection and takedown workflows. If legitimate content is being used as camouflage, manual review alone will miss the pattern because the malicious post is designed to look like normal community activity.

Technical breakdown

How account credibility becomes an attack primitive

The campaign pattern described here starts before the malicious link is even clicked. Attackers buy aged accounts, rebrand them for crypto relevance, and pay for verification so the account inherits trust signals that recommendation systems and users are likely to reward. They then layer follower inflation and coordinated reposting to manufacture legitimacy. This is not traditional credential theft, but it is a trust-compromise pattern that turns identity signals into delivery infrastructure. The attacker does not need to compromise the victim's wallet until the final step. The platform account itself is the staging layer that makes the lure believable.

Practical implication: Practitioners should treat compromised, purchased or rebranded accounts as delivery infrastructure and monitor for identity signal abuse, not just malicious URLs.

Why malicious dApps succeed at the wallet boundary

A crypto drainer is malicious code embedded inside a fake dApp that asks the user to connect a wallet and sign a transaction. The theft happens when the signed transaction authorises asset movement, which means the user’s approval becomes the execution path for exfiltration. Cloudflare hiding and cloned domains extend the lifespan of the lure, but the decisive control failure is that the user is asked to trust a transaction context that has not been independently verified. In identity terms, the problem is not just authentication. It is the absence of trustworthy provenance for the request itself. See the Web3 and Crypto Security Guide.

Practical implication: Security teams should make transaction provenance visible before signing, not rely on post-connection alerts alone.

Why recommendation systems amplify drainer campaigns

The article shows a repeatable distribution model built around algorithmic amplification, coordinated reposts and social proof. High-frequency posting, trending cashtags and networks of accounts create artificial consensus, while verified or aged profiles reduce skepticism. For defenders, this means the threat is not isolated to malicious domains. It is a multi-layer delivery chain in which platform features, account reputation and content mechanics all contribute to reach. The more the campaign looks like routine crypto activity, the more likely it is to evade both users and basic moderation systems.

Practical implication: Defenders need detection that correlates account behaviour, content patterns and destination domains instead of reviewing each post in isolation.

Threat narrative

Attacker objective: The attacker wants victims to connect wallets and sign malicious transactions so cryptocurrency can be drained quickly and at scale.

1. Entry occurs when attackers use aged, rebranded or verified X accounts to publish posts that appear credible inside Web3 communities.
2. Credential_harvested is not the primary issue here; instead, the campaign harvests trust by converting platform identity signals into a distribution advantage for malicious dApps.
3. Escalation happens when victims click through to fake airdrop or token-claim sites and connect wallets, then sign transactions that authorise asset transfer.
4. Impact is direct wallet theft, with assets drained to attacker-controlled addresses and malicious links reused across large account networks.

Breaches seen in the wild

• Twitter source code leak 2023: Twitter source code and internal tools were posted to GitHub by "FreeSpeechEnthusiast" and stayed public for months before a 2023 takedown.
• Lottie Player npm compromise 2024: A compromised developer npm token let attackers publish three Lottie Player versions that pushed a crypto wallet drainer to websites.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity trust is now part of the attack surface for wallet theft. These campaigns do not start at the wallet prompt. They begin by manufacturing account legitimacy through age, verification and follower signals, then convert that legitimacy into click-through and signing behaviour. That means identity governance in Web3 has to account for how trust is earned, displayed and abused before any transaction occurs.

Social platforms have become control gaps, not just distribution channels. X is not merely hosting the scam; the platform mechanics help the scam scale through algorithmic amplification, repost networks and paid verification. The practical lesson is that threat intelligence must join account reputation, content analysis and transaction monitoring in one workflow, because each signal alone is incomplete.

Wallet security now depends on provenance, not just permission. A signed transaction can be technically authorised and still be socially fraudulent if the request originated from a manipulated account or a cloned dApp. Web3 and crypto security should therefore be treated as a governance problem around request authenticity, not only a protection problem around private keys.

Drainer-as-a-Service is a mature fraud supply chain. The article describes a split between developers who build the malicious kits and affiliates who source traffic, which is the same operational logic seen in other criminal-as-a-service ecosystems. That structure makes disruption harder because takedown of one posting account rarely removes the broader distribution model.

Named concept: platform-trust laundering. The campaign launders legitimacy through aged accounts, verification badges, reposts and crypto jargon until malicious links look like ordinary community activity. Once trust has been laundered in this way, the defender is no longer screening obvious spam but ordinary-looking identity signals that have been repurposed for theft.

What this signals

Platform-trust laundering: attackers can turn account age, verification and crypto jargon into a synthetic trust layer that makes malicious dApps look routine. Defenders should assume the credibility of the posting account is no longer a reliable proxy for the safety of the destination, especially when social content leads directly to wallet signing.

This shifts the programme focus from blocking obviously bad domains to governing the full trust path from post to wallet. The operational question is whether your controls can evaluate provenance, destination and transaction intent in one flow, not whether a link looks suspicious in isolation.

For practitioners

• Monitor for platform trust abuse Track aged-account purchases, sudden crypto rebranding, paid verification changes and follower anomalies as indicators that an account has become distribution infrastructure.
• Correlate post behaviour with destination risk Join social-content telemetry to URL reputation, domain similarity and wallet interaction data so a suspicious post can be suppressed before it reaches a signing flow.
• Warn before wallet connection and signing Surface provenance checks at the point where a user is asked to connect a wallet or approve a transaction, because the attack succeeds only when trust is transferred into signing.
• Review account-level trust controls Use stronger verification and monitoring for branded or official community accounts, especially where social platforms are used to distribute time-sensitive announcements.
• Build takedown playbooks around repeat abuse Prepare a process for reporting malicious posts, preserving evidence and blocking repeat domains, because these campaigns reappear across multiple accounts and repost chains.

Key takeaways

• Crypto drainer campaigns now exploit social trust as much as technical weakness, which makes account credibility part of the attack path.
• The article shows that verified, aged or rebranded accounts can provide the delivery layer for wallet theft across multiple chains and campaigns.
• Defenders need controls that evaluate post provenance, destination risk and signing context together, because the loss occurs at the wallet boundary.

Related NHI Mgmt Group resources: Web3 and Crypto Security Guide · Crypto Wallet Security Guide · Security Data Pipeline Guide

Key terms

• Crypto Drainer: A crypto drainer is malware or a malicious workflow that tricks a user into granting transaction authority so assets can be moved without further approval. In practice, the identity risk sits in the permission grant, the approval context, and the surrounding secret exposure that can extend the theft beyond one wallet interaction.
• Drainer-as-a-Service: Drainer-as-a-Service is a commoditised criminal model where phishing kits, smart contracts, and infrastructure are sold or shared for a cut of stolen funds. It lowers attacker skill requirements and turns wallet abuse into a repeatable campaign model with predictable operational components.
• Social Proof: A trust signal derived from visible online presence such as profiles, connections, and activity history. In fraud operations, it can help with context but should never be treated as proof that an identity is genuine, because it is cheap to manufacture and easy to backfill.
• Wallet Signing: Wallet signing is the act of approving a blockchain transaction with a private key or connected wallet. In legitimate use it confirms intent, but attackers exploit it by presenting malicious transfers as routine actions, causing the victim to authorize theft without realizing it.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity governance to the broader security decisions their programmes depend on.