Crypto drainers on X: what it means for wallet security teams

TL;DR: Crypto drainers are increasingly using X to distribute malicious dApps at scale, with campaigns such as AngelFerno and Rublevka combining aged accounts, paid verification, social proof and Cloudflare hiding to make wallet-draining links look legitimate, according to Blockaid.

Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “How Crypto Drainers Are Using X (Twitter) to Target Web3 Users”.

By the numbers:

• Blockaid scanned over 2.4 billion transactions in 2024 and blocked 71 million attacks.
• Blockaid detected 20 different X accounts sharing malicious AngelFerno dApps between September 2025 and January 2026.
• Blockaid detected more than 260 distinct URLs of Rublevka-associated dApps shared as part of the campaign.

Key questions

Q: What breaks when crypto drainers use trusted social accounts to distribute malicious dApps?

A: The control that breaks is the assumption that a credible-looking account is a safe source of links.

Q: Why do social proof and verification badges increase crypto drainer success?

A: They reduce the friction that normally makes users pause before clicking or signing.

Q: How can teams reduce wallet-drainer risk from social media campaigns?

A: Combine content monitoring, URL reputation, domain similarity checks and transaction-risk scoring so suspicious links can be blocked before a wallet is connected.

Practitioner guidance

• Monitor for platform trust abuse Track aged-account purchases, sudden crypto rebranding, paid verification changes and follower anomalies as indicators that an account has become distribution infrastructure.
• Correlate post behaviour with destination risk Join social-content telemetry to URL reputation, domain similarity and wallet interaction data so a suspicious post can be suppressed before it reaches a signing flow.
• Warn before wallet connection and signing Surface provenance checks at the point where a user is asked to connect a wallet or approve a transaction, because the attack succeeds only when trust is transferred into signing.

Bottom line: Crypto drainer campaigns now exploit social trust as much as technical weakness, which makes account credibility part of the attack path.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →