# Drain Watch

> Live wallet-drain incidents on Solana and EVM chains: drainer kits, signature phishing, malicious extensions, fake bots, leaked keys and supply-chain stealers, and whether each is still active.

Static site, rebuilt on every content change. All endpoints are plain files with CORS enabled; no auth.

## Endpoints
- [All incidents](https://drains.watch/incidents.json): every incident (newest first by start date) with severity, threat status (active / partly-contained / contained), chains, method, reported loss and updatedAt.
- [One incident](https://drains.watch/i/{slug}.json): full record incl. timeline, sources, indicators (drainer domains, defanged, and addresses) and `agentBrief` (Markdown safety brief).
- Follow one incident: https://drains.watch/i/{slug}/feed.xml (RSS, one item per update), https://drains.watch/i/{slug}/llms.txt.
- [Changes](https://drains.watch/changes.json): every timeline update across incidents, newest first. Poll this to watch for news.
- [RSS](https://drains.watch/feed.xml): one item per incident (latest 50 by last update).
- AI-driven hacks (AI did the attacking, made the lure, wrote the malware, or was the way in): https://drains.watch/ai-hacks (HTML), https://drains.watch/t/ai.json, https://drains.watch/t/ai/feed.xml, https://drains.watch/t/ai/llms.txt. Records carry `ai: { role, note }` (roles: agent-attack, ai-lure, ai-malware, agent-target).
- [Drain methods](https://drains.watch/methods.json): how each drain method works, red flags, and how to protect yourself.
- Per tag (chains, methods, wallets, channels, drainer kits): https://drains.watch/t/{tag}.json, https://drains.watch/t/{tag}/feed.xml, https://drains.watch/t/{tag}/llms.txt. Index: https://drains.watch/tags.json.
- HTML: https://drains.watch/ (live), https://drains.watch/past, https://drains.watch/i/{slug}, https://drains.watch/t/{tag}, https://drains.watch/tags, https://drains.watch/methods, https://drains.watch/m/{method}, https://drains.watch/d/{YYYY-MM-DD}.

## Safety rules for agents
- Never ask a user for, store or handle a seed phrase or private key. Checks are read-only, from public addresses.
- Never open the indicator domains; they are drainer sites.

## Live now (24)
- [Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet](https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026): Medium, Still active, Ethereum, since Oct 14, 2026
- [COLDCARD's X account posts fake 'security migration' phishing link](https://drains.watch/i/coldcard-x-account-phishing-post-oct-2026): Medium, Contained, Bitcoin, since Oct 11, 2026
- [Noir wallet drainer kit hides its backend behind DNS TXT records and DoH](https://drains.watch/i/noir-drainer-dns-txt-c2-oct-2026): High, Still active, Multiple EVM chains, since Oct 9, 2026
- [Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M](https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets): Critical, Partly contained, Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin, since Oct 9, 2026
- [Fake 'human verification' bookmarklet hijacks Fomo account, drains about $48K from embedded wallet](https://drains.watch/i/fomo-bookmarklet-fake-verification-oct-2026): Medium, Still active, Solana, since Oct 8, 2026
- [16 fake Rabby and OKX Wallet add-ons on Firefox stole recovery phrases and private keys](https://drains.watch/i/firefox-fake-rabby-okx-wallet-extensions-oct-2026): Medium, Partly contained, Multiple EVM chains, since Oct 5, 2026
- [User loses about $305K in DAI after copying a poisoned lookalike address from history](https://drains.watch/i/address-poisoning-305k-dai-oct-2026): High, Still active, Multiple EVM chains, since Oct 4, 2026
- [Old Permit2 phishing approval used to drain $167K in LINK](https://drains.watch/i/permit2-phishing-link-167k-oct-2026): High, Still active, Ethereum, since Oct 3, 2026
- [Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances](https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026): Critical, Contained, Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, Base, since Sep 24, 2026
- [SingularityNET bridge keys abused after cloud breach: 8.72M FET released, billions of tokens minted](https://drains.watch/i/singularitynet-bridge-signing-key-compromise-sep-2026): Critical, Partly contained, Ethereum, BNB Chain, since Sep 19, 2026
- [Joint advisory: North Korea's WaterPlum fake-job campaign infected 30,000 devices, hit 7,000+ wallets](https://drains.watch/i/waterplum-contagious-interview-advisory-sep-2026): Critical, Still active, Multiple EVM chains, since Sep 18, 2026
- [D'CENT app-wallet users drained of over $18M as compromised seeds hit XRP, Ethereum, Bitcoin and Tron](https://drains.watch/i/dcent-app-wallet-seed-compromise-sep-2026): Critical, Still active, Ethereum, Tron, Bitcoin, since Sep 15, 2026
- [Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief](https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026): Critical, Partly contained, Ethereum, since Sep 15, 2026
- [Knostic: 'gadgethumans-mcp' npm MCP server sends users' raw wallet private key to a remote server](https://drains.watch/i/gadgethumans-mcp-npm-sends-wallet-private-key-sep-2026): Medium, Still active, Base, since Sep 8, 2026
- [19 Chrome and Edge extensions hid a wallet drainer that hijacked Connect Wallet and Swap buttons](https://drains.watch/i/chrome-edge-19-extensions-wallet-drainer-aug-2026): High, Partly contained, Multiple EVM chains, Solana, Tron, since Aug 30, 2026
- [Whale drained of $25.6M in aWBTC, DAI, WBTC and ETH; same wallet lost $24M to phishing in 2023](https://drains.watch/i/whale-wallet-25m-drain-aug-2026): Critical, Still active, Ethereum, since Aug 12, 2026
- [USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts](https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026): Low, Still active, Multiple EVM chains, since Aug 1, 2026
- [Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON](https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026): Critical, Partly contained, Solana, Ethereum, Tron, since Jul 24, 2026
- [Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions](https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026): Critical, Contained, Solana, since Apr 1, 2026
- [Report: Inferno/AngelFerno drainer still active in 2026, bought Purple Drainer in March](https://drains.watch/i/inferno-angelferno-drainer-still-active-oct-2026): Critical, Still active, Multiple EVM chains, since Mar 1, 2026
- [Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys](https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026): High, Partly contained, Solana, Multiple EVM chains, since Feb 5, 2026
- [Ongoing wave: bookmarklet drainers target logged-in Solana memecoin trading apps](https://drains.watch/i/bookmarklet-drains-solana-trading-terminals-wave): High, Still active, Solana, since Dec 26, 2025
- [Solana owner-permission phishing: OKX Wallet and Phantom add warnings after $3M loss](https://drains.watch/i/solana-owner-permission-phishing-3m-dec-2025): Critical, Partly contained, Solana, since Dec 5, 2025
- [Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses](https://drains.watch/i/solana-address-poisoning-wave-2025-2026): Critical, Still active, Solana, since Nov 17, 2025

## Tags
- [Ethereum](https://drains.watch/t/ethereum): 34 incidents, 9 live · [json](https://drains.watch/t/ethereum.json) · [rss](https://drains.watch/t/ethereum/feed.xml)
- [Multiple EVM chains](https://drains.watch/t/multi-evm): 27 incidents, 8 live · [json](https://drains.watch/t/multi-evm.json) · [rss](https://drains.watch/t/multi-evm/feed.xml)
- [Solana](https://drains.watch/t/solana): 27 incidents, 9 live · [json](https://drains.watch/t/solana.json) · [rss](https://drains.watch/t/solana/feed.xml)
- [AI-driven](https://drains.watch/t/ai): 26 incidents, 5 live · [json](https://drains.watch/t/ai.json) · [rss](https://drains.watch/t/ai/feed.xml)
- [Social engineering and fake support](https://drains.watch/t/social-engineering): 15 incidents, 3 live · [json](https://drains.watch/t/social-engineering.json) · [rss](https://drains.watch/t/social-engineering/feed.xml)
- [Supply-chain stealers](https://drains.watch/t/supply-chain): 14 incidents, 2 live · [json](https://drains.watch/t/supply-chain.json) · [rss](https://drains.watch/t/supply-chain/feed.xml)
- [Leaked private keys and seed phrases](https://drains.watch/t/key-leak): 14 incidents, 3 live · [json](https://drains.watch/t/key-leak.json) · [rss](https://drains.watch/t/key-leak/feed.xml)
- [Bitcoin](https://drains.watch/t/bitcoin): 13 incidents, 3 live · [json](https://drains.watch/t/bitcoin.json) · [rss](https://drains.watch/t/bitcoin/feed.xml)
- [Infostealer](https://drains.watch/t/infostealer): 10 incidents, 2 live · [json](https://drains.watch/t/infostealer.json) · [rss](https://drains.watch/t/infostealer/feed.xml)
- [Tron](https://drains.watch/t/tron): 9 incidents, 4 live · [json](https://drains.watch/t/tron.json) · [rss](https://drains.watch/t/tron/feed.xml)
- [DPRK (North Korea)](https://drains.watch/t/dprk): 9 incidents, 3 live · [json](https://drains.watch/t/dprk.json) · [rss](https://drains.watch/t/dprk/feed.xml)
- [npm](https://drains.watch/t/npm): 9 incidents, 2 live · [json](https://drains.watch/t/npm.json) · [rss](https://drains.watch/t/npm/feed.xml)
- [BNB Chain](https://drains.watch/t/bsc): 7 incidents, 3 live · [json](https://drains.watch/t/bsc.json) · [rss](https://drains.watch/t/bsc/feed.xml)
- [Base](https://drains.watch/t/base): 7 incidents, 2 live · [json](https://drains.watch/t/base.json) · [rss](https://drains.watch/t/base/feed.xml)
- [Seed Phrase](https://drains.watch/t/seed-phrase): 7 incidents, 1 live · [json](https://drains.watch/t/seed-phrase.json) · [rss](https://drains.watch/t/seed-phrase/feed.xml)
- [Ai Agent](https://drains.watch/t/ai-agent): 7 incidents, 2 live · [json](https://drains.watch/t/ai-agent.json) · [rss](https://drains.watch/t/ai-agent/feed.xml)
- [Ledger](https://drains.watch/t/ledger): 6 incidents, 2 live · [json](https://drains.watch/t/ledger.json) · [rss](https://drains.watch/t/ledger/feed.xml)
- [Tornado Cash](https://drains.watch/t/tornado-cash): 6 incidents, 1 live · [json](https://drains.watch/t/tornado-cash.json) · [rss](https://drains.watch/t/tornado-cash/feed.xml)
- [Telegram](https://drains.watch/t/telegram): 6 incidents, 0 live · [json](https://drains.watch/t/telegram.json) · [rss](https://drains.watch/t/telegram/feed.xml)
- [macOS](https://drains.watch/t/macos): 6 incidents, 1 live · [json](https://drains.watch/t/macos.json) · [rss](https://drains.watch/t/macos/feed.xml)
- [Phishing](https://drains.watch/t/phishing): 5 incidents, 2 live · [json](https://drains.watch/t/phishing.json) · [rss](https://drains.watch/t/phishing/feed.xml)
- [Polygon](https://drains.watch/t/polygon): 5 incidents, 1 live · [json](https://drains.watch/t/polygon.json) · [rss](https://drains.watch/t/polygon/feed.xml)
- [Malicious browser extensions](https://drains.watch/t/malicious-extension): 5 incidents, 2 live · [json](https://drains.watch/t/malicious-extension.json) · [rss](https://drains.watch/t/malicious-extension/feed.xml)
- [Address poisoning](https://drains.watch/t/address-poisoning): 5 incidents, 2 live · [json](https://drains.watch/t/address-poisoning.json) · [rss](https://drains.watch/t/address-poisoning/feed.xml)
- [Scam Sniffer](https://drains.watch/t/scam-sniffer): 5 incidents, 1 live · [json](https://drains.watch/t/scam-sniffer.json) · [rss](https://drains.watch/t/scam-sniffer/feed.xml)
- [Multisig](https://drains.watch/t/multisig): 5 incidents, 2 live · [json](https://drains.watch/t/multisig.json) · [rss](https://drains.watch/t/multisig/feed.xml)
- [Private Key](https://drains.watch/t/private-key): 5 incidents, 1 live · [json](https://drains.watch/t/private-key.json) · [rss](https://drains.watch/t/private-key/feed.xml)
- [Fake Meeting](https://drains.watch/t/fake-meeting): 5 incidents, 0 live · [json](https://drains.watch/t/fake-meeting.json) · [rss](https://drains.watch/t/fake-meeting/feed.xml)
- [Seed Phrase Theft](https://drains.watch/t/seed-phrase-theft): 4 incidents, 2 live · [json](https://drains.watch/t/seed-phrase-theft.json) · [rss](https://drains.watch/t/seed-phrase-theft/feed.xml)
- [Slowmist](https://drains.watch/t/slowmist): 4 incidents, 2 live · [json](https://drains.watch/t/slowmist.json) · [rss](https://drains.watch/t/slowmist/feed.xml)
- [Browser Extension](https://drains.watch/t/browser-extension): 4 incidents, 2 live · [json](https://drains.watch/t/browser-extension.json) · [rss](https://drains.watch/t/browser-extension/feed.xml)
- [Lookalike Address](https://drains.watch/t/lookalike-address): 4 incidents, 1 live · [json](https://drains.watch/t/lookalike-address.json) · [rss](https://drains.watch/t/lookalike-address/feed.xml)
- [Signature Phishing](https://drains.watch/t/signature-phishing): 4 incidents, 2 live · [json](https://drains.watch/t/signature-phishing.json) · [rss](https://drains.watch/t/signature-phishing/feed.xml)
- [Hot Wallet](https://drains.watch/t/hot-wallet): 4 incidents, 2 live · [json](https://drains.watch/t/hot-wallet.json) · [rss](https://drains.watch/t/hot-wallet/feed.xml)
- [Private Key Compromise](https://drains.watch/t/private-key-compromise): 4 incidents, 0 live · [json](https://drains.watch/t/private-key-compromise.json) · [rss](https://drains.watch/t/private-key-compromise/feed.xml)
- [Whale](https://drains.watch/t/whale): 4 incidents, 2 live · [json](https://drains.watch/t/whale.json) · [rss](https://drains.watch/t/whale/feed.xml)
- [Aave](https://drains.watch/t/aave): 4 incidents, 1 live · [json](https://drains.watch/t/aave.json) · [rss](https://drains.watch/t/aave/feed.xml)
- [Malicious token and NFT approvals](https://drains.watch/t/approval-phishing): 4 incidents, 0 live · [json](https://drains.watch/t/approval-phishing.json) · [rss](https://drains.watch/t/approval-phishing/feed.xml)
- [USDT](https://drains.watch/t/usdt): 4 incidents, 1 live · [json](https://drains.watch/t/usdt.json) · [rss](https://drains.watch/t/usdt/feed.xml)
- [AI agent hijacking](https://drains.watch/t/agent-hijack): 4 incidents, 0 live · [json](https://drains.watch/t/agent-hijack.json) · [rss](https://drains.watch/t/agent-hijack/feed.xml)
- [Front-end and DNS hijacks](https://drains.watch/t/front-end-hijack): 4 incidents, 0 live · [json](https://drains.watch/t/front-end-hijack.json) · [rss](https://drains.watch/t/front-end-hijack/feed.xml)
- [PyPI](https://drains.watch/t/pypi): 4 incidents, 0 live · [json](https://drains.watch/t/pypi.json) · [rss](https://drains.watch/t/pypi/feed.xml)
- [Fake airdrop, claim and mint sites](https://drains.watch/t/fake-airdrop-site): 4 incidents, 0 live · [json](https://drains.watch/t/fake-airdrop-site.json) · [rss](https://drains.watch/t/fake-airdrop-site/feed.xml)
- [Fake wallet and trading apps](https://drains.watch/t/fake-app): 4 incidents, 0 live · [json](https://drains.watch/t/fake-app.json) · [rss](https://drains.watch/t/fake-app/feed.xml)
- [Deepfake](https://drains.watch/t/deepfake): 4 incidents, 0 live · [json](https://drains.watch/t/deepfake.json) · [rss](https://drains.watch/t/deepfake/feed.xml)
- [Zoom](https://drains.watch/t/zoom): 4 incidents, 0 live · [json](https://drains.watch/t/zoom.json) · [rss](https://drains.watch/t/zoom/feed.xml)
- [Account Takeover](https://drains.watch/t/account-takeover): 4 incidents, 1 live · [json](https://drains.watch/t/account-takeover.json) · [rss](https://drains.watch/t/account-takeover/feed.xml)
- [EIP-7702 delegation phishing](https://drains.watch/t/eip-7702-phishing): 3 incidents, 2 live · [json](https://drains.watch/t/eip-7702-phishing.json) · [rss](https://drains.watch/t/eip-7702-phishing/feed.xml)
- [EIP-7702](https://drains.watch/t/eip-7702): 3 incidents, 2 live · [json](https://drains.watch/t/eip-7702.json) · [rss](https://drains.watch/t/eip-7702/feed.xml)
- [Hardware Wallet](https://drains.watch/t/hardware-wallet): 3 incidents, 2 live · [json](https://drains.watch/t/hardware-wallet.json) · [rss](https://drains.watch/t/hardware-wallet/feed.xml)
- [Drainer-as-a-service](https://drains.watch/t/drainer-as-a-service): 3 incidents, 2 live · [json](https://drains.watch/t/drainer-as-a-service.json) · [rss](https://drains.watch/t/drainer-as-a-service/feed.xml)
- [Bookmarklet drains](https://drains.watch/t/bookmarklet): 3 incidents, 2 live · [json](https://drains.watch/t/bookmarklet.json) · [rss](https://drains.watch/t/bookmarklet/feed.xml)
- [Session Hijack](https://drains.watch/t/session-hijack): 3 incidents, 2 live · [json](https://drains.watch/t/session-hijack.json) · [rss](https://drains.watch/t/session-hijack/feed.xml)
- [Stablecoin](https://drains.watch/t/stablecoin): 3 incidents, 1 live · [json](https://drains.watch/t/stablecoin.json) · [rss](https://drains.watch/t/stablecoin/feed.xml)
- [Permit and Permit2 signature phishing](https://drains.watch/t/permit-phishing): 3 incidents, 1 live · [json](https://drains.watch/t/permit-phishing.json) · [rss](https://drains.watch/t/permit-phishing/feed.xml)
- [Bridge](https://drains.watch/t/bridge): 3 incidents, 1 live · [json](https://drains.watch/t/bridge.json) · [rss](https://drains.watch/t/bridge/feed.xml)
- [Trezor](https://drains.watch/t/trezor): 3 incidents, 1 live · [json](https://drains.watch/t/trezor.json) · [rss](https://drains.watch/t/trezor/feed.xml)
- [Clickfix](https://drains.watch/t/clickfix): 3 incidents, 1 live · [json](https://drains.watch/t/clickfix.json) · [rss](https://drains.watch/t/clickfix/feed.xml)
- [MetaMask](https://drains.watch/t/metamask): 3 incidents, 1 live · [json](https://drains.watch/t/metamask.json) · [rss](https://drains.watch/t/metamask/feed.xml)
- [Treasury](https://drains.watch/t/treasury): 3 incidents, 1 live · [json](https://drains.watch/t/treasury.json) · [rss](https://drains.watch/t/treasury/feed.xml)