Topic starter
25/10/2026 11:00 am
TL;DR: Crypto drainer campaigns are using aged, verified and rebranded X accounts to make wallet-draining dApps look legitimate, according to Blockaid. Wallet security has to weigh post provenance, destination risk and signing context together before a user connects.
Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “How Crypto Drainers Are Using X (Twitter) to Target Web3 Users”.
By the numbers:
- Blockaid scanned over 2.4 billion transactions in 2024 and blocked 71 million attacks.
- Blockaid detected 20 different X accounts sharing malicious AngelFerno dApps between September 2025 and January 2026.
- Blockaid detected more than 260 distinct URLs of Rublevka-associated dApps shared as part of the campaign.
Key questions
Q: Why do social proof and verification badges increase crypto drainer success?
A: They reduce the friction that normally makes users pause before clicking or signing.
Q: How can teams reduce wallet-drainer risk from social media campaigns?
A: Combine content monitoring, URL reputation, domain similarity checks and transaction-risk scoring so suspicious links can be blocked before a wallet is connected.
Q: What breaks when crypto drainers use trusted social accounts to distribute malicious dApps?
A: The control that breaks is the assumption that a credible-looking account is a safe source of links.
Practitioner guidance
- Monitor for platform trust abuse Track aged-account purchases, sudden crypto rebranding, paid verification changes and follower anomalies as indicators that an account has become distribution infrastructure.
- Correlate post behaviour with destination risk Join social-content telemetry to URL reputation, domain similarity and wallet interaction data so a suspicious post can be suppressed before it reaches a signing flow.
- Warn before wallet connection and signing Surface provenance checks at the point where a user is asked to connect a wallet or approve a transaction, because the attack succeeds only when trust is transferred into signing.
Bottom line: Crypto drainer campaigns now exploit social trust as much as technical weakness, which makes account credibility part of the attack path.
Glossary terms: Crypto Drainer, Drainer-as-a-Service, Social Proof, Wallet Signing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Identity trust is now part of the attack surface for wallet theft. These campaigns do not start at the wallet prompt. They begin by manufacturing account legitimacy through age, verification and follower signals, then convert that legitimacy into click-through and signing behaviour. That means identity governance in Web3 has to account for how trust is earned, displayed and abused before any transaction occurs.
A question worth separating out:
Q: What should organisations do when a crypto scam uses both legitimate reposts and malicious links?
A: Treat the campaign as coordinated abuse rather than isolated spam. Preserve the URLs, account handles and repost relationships, then feed them into detection and takedown workflows. If legitimate content is being used as camouflage, manual review alone will miss the pattern because the malicious post is designed to look like normal community activity.
👉 Read our full editorial: X is becoming a primary delivery channel for crypto drainers
This post was modified 7 days ago by NHI Mgmt Group