Inferno Drainer Is Burning Out

Fig 1. "My mind is going. I can feel it." – Inferno experiencing its own operational decline.

Abstract

Inferno Drainer (also known as AngelFerno, SeedFerno, SolFerno, TronFerno, SUIFerno and XRPFerno, among others) is arguably the most prolific "drainer-as-a-service" (or DaaS) line ever developed. It originally emerged in late 2022 and its original iteration is estimated to have stolen approximately $80 million USD in assets from 2022 to 2023, when the brand suddenly shuttered. Since then, what was formerly known as Inferno has been rebranded several times following various mergers, most notably with Angel Drainer in 2025 to become AngelFerno.

The larger Inferno ecosystem has continued to operate for several years under a much lower profile while still maintaining a large affiliate base and draining untold millions in assets. However, independent deobfuscation of three consecutive Inferno payload generations (paired with affiliate panel access and months of monitoring admin activity) shows what can only be described as a sharp decline in technical and operational competence. All of this suggests a core talent exodus following Inferno's initial run, which its current admins have since struggled to compensate for.

Scope & Methodology

This blog will dive into Inferno Drainer and its derivatives, including its product line, the internal structure of the drainer and its payload, its C2 infrastructure and multi-chain reach, and analysis of a large-scale attack captured in real time using the visibility accesses our team were able to obtain during research.

It will also detail the infrastructure built around Inferno, specifically its power hierarchy, affiliate structure, attack pattern cadence and degradation over time.

NOTE: Some of what underlies this report is deliberately not published here in full: private-key material, the exact cryptographic keys and decryption code that would let a third party reproduce our access to the operator's live infrastructure, personal data belonging to victims, and specific components of an ongoing identification effort toward the human operators have been omitted.

For additional queries regarding our research, please email m.smith@worldethicaldata.org.

This research draws from the following sources:

• Three build generations of the Inferno operation's drainer, independently deobfuscated by World Ethical Data's security division. These builds were then broken down to module level for cross-generation comparison.
• Decryption of the operator's on-chain command configuration and C2 traffic.
• Chronological timeline reconstructing the complete operational history from on-chain transaction data.
• Our continuous monitoring system, which ran on dedicated infrastructure with multiple daemons polling every 30–60 seconds across 40-plus chains. This was driven by a machine-validated, adversarially challenged entity registry across eight domains. The monitor was keyed to the operation's actual on-chain command pipeline, which autonomously records victim drains as they occur, maintaining a cumulative victim ledger.
  • First records from this monitoring system were created 2026-03-23 and include fund flow, SecureProxy, general monitor logs, and alerts with a 14-day turnover unless instructed.

For Defenders: Drainer-specific Recommendations

• Revoke Permit2 approvals. Users who have interacted with any identified phishing domain should audit and revoke Permit2 token permissions via revoke.cash or etherscan.io/tokenapprovalchecker.
• Audit ERC-20/721/1155 approvals. Inferno has been known to use approve(), setApprovalForAll(), and increaseAllowance() as fallback drain strategies. Check all token approvals on chains where the wallet was connected.
• Block drainer CDN dependencies. Network-level blocking of openfpcdn.io (bot detection) and the CryptoJS CDN path prevents the drainer from initialising.
• Coordinate with wallet providers. Share targeting patterns with MetaMask, Rabby, and Phantom for improved signature request warnings. Inferno has been known to specifically target these wallets via InjectedConnector.
• Enact defensive domain registration and set up Google Safe Browsing alerts for all identified phishing domains.

Part I: Inferno Threat Context

Cryptodrainer / Drainer-as-a-Service Ecosystem

A cryptodrainer (or "drainer") is itself an umbrella term for TTPs in the Web3 space which trick users into authorising fraudulent transactions that unknowingly drain their cryptocurrency wallet.

Fig 2. Example of a DaaS phishing campaign impersonation [Source]

Although drainers specifically target cryptowallets and funds located on the blockchain, the mechanism by which they scam victims is essentially the same as a Web2 phishing attack. The attacks, primarily deployed via Drainer-as-a-Service (DaaS) kits, still use the basic social engineering and impersonation scams common in other phishing kits to coerce victims into signing over their assets or exposing their "seed phrase", or recovery phrase. Generally, victims of these scams believe that they are either connecting a wallet, claiming an airdrop, or minting an NFT.

Threat actors who focus on drainer operations benefit from the blockchain system structurally because, by definition, there is no issuer or middleman involved. On the chain, a valid signature is considered absolute consent to transfer funds, and it is final. There is no chargeback, no fraud desk, and no way to reverse the transaction once completed.

Fig 3. Basic DaaS attacker flow.

What exactly does "Inferno Drainer" refer to?

After the original Inferno DaaS operation shut down in late 2023, it eventually re-emerged in 2025 under a merger brand with Angel Drainer referred to as "AngelFerno", which has since acquired additional external drainer operations such as those of Purple Drainer, as well as launching multiple variations of its own product line, such as "SeedFerno".

Fig 4. Community post on Telegram announcing Purple's acquisition by AngelFerno, March 2026.

Currently, "Inferno" is a loose attributive label for a variety of TTPs within a singular threat ecosystem. It is both the name of the DaaS platform as well as its associated operations, which include its operator tooling, infrastructure, and various builds. Because of this, Inferno Drainer should not be thought of as a singular tool, but rather a cryptodrainer brand, presented to its affiliates the way a vendor might present a product family.

To further complicate matters, the drainer panel only self-brands as Inferno while specifically labelling its EVM drainer as "AngelFerno" and marketing it as a flagship product rather than the overarching name of the operation.

Fig 5. Inferno builder panel UI showing "AngelFerno" and "SeedFerno" options.

NOTE: For the sake of simplicity, when referring to existing operations, we will continue to refer to the overarching Inferno ecosystem, infrastructure and brand variations as "Inferno", and only use specialty names like "AngelFerno" when specifically referring to the builder panel option.

Inferno Brand Timeline

Fig 6. Inferno brand timeline infographic.

November 2022: First public appearance of the Inferno brand via Telegram channel, originally called "Inferno Multichain Drainer".

Fig 7. Screenshot of post from Inferno Multichain Drainer Telegram channel dated November 5, 2022 [Source]

November 2023: Closure announcement for the original Inferno brand, just over one year from initial launch.

Fig 8. Screenshot of post from Inferno Multichain Drainer Telegram channel dated November 26, 2023 [Source]

December 2024: First appearance of the merger brand between Angel Drainer and Inferno (AngelFerno) on the Russian forum lolz[.]live. The AngelFerno account heavily advertised a giveaway of 1,000,000 rubles for the new year.

Fig 9. Screenshot of post from lolz[.]live forum dated December 24, 2024.

March 2025: Solana capabilities added to the new Inferno drainer, starting the trend of SolFerno / SeedFerno / XRPFerno brand releases.

Fig 10. Screenshot of post from Telegram channel announcing Solana capability add.

April 2025: AngelFerno panel update announced. Note the panel was still using the "AngelFerno" name for branding at this time, and claims and logs were still handled within the panel interface (as opposed to Telegram bots).

Fig 11. Screenshot of post from Telegram channel showcasing new AngelFerno panel interface.

October 2025: TronFerno beta announced, integrating TRON wallet capabilities.

Fig 12. Screenshot of post from Telegram channel announcing TRON capability add.

December 2025: A one-time entry tax of $1,000 USD is introduced, along with the announcement of SeedFerno, which was notably immediately exempt.

Via our own reverse-engineering of the payload and observations from the operator's panel, WEDF notes that "SeedFerno", which is marketed as a free gift for beginner affiliates, is not actually a separate tool, but a toggle switch. The capability is hardcoded into the on-chain contract and simply toggled on or off, per affiliate, from the panel. It has been present since the very first Inferno payload. So offering it "for free" costs the admins nothing to provide, and merely functions as sales psychology.

Fig 13. Screenshots of posts from Telegram channel announcing the novel Angel Tax, immediately followed by a post excluding SeedFerno from the fee. The tax amount oscillates, having also been $500 and $300 USD, as well as occasional "free periods" to promote new capability adds.

Fig 14. Screenshot of post from Telegram channel announcing SeedFerno capability add.

March 2026: Purple Drainer announces it has been acquired by AngelFerno, although it is never integrated into the mainline Inferno branding.

Fig 15. Screenshot of post from Telegram channel announcing Purple Drainer's acquisition by AngelFerno.

May 2026: SUIFerno add-on announcement.

Fig 16. Screenshot of post from Telegram channel announcing SUI capability add.

Inferno's Scale & Reach

According to figures from within the Inferno operator panel, one mid-tier affiliate account (rank 54, level 4) showed 1,451 recorded "hits" and a cumulative hits value of approximately $1,003,911 USD, meaning a single mid-ranked affiliate exceeded $1 million USD in recorded asset theft. One freshly created account appeared at rank 3074, indicating the affiliate base numbers in the thousands.

Inferno's deployment model (drainer factory) involves a CREATE2 contract that mints a fresh, single-use drainer contract for each deployment, over seventeen thousand of them to date. This means there is not a single shared on-chain artifact which can be pulled in order to dismantle the whole operation.

Fig 17. Infographic showing how CREATE2 contracts are used to bypass wallet security checks [Source]

On-chain, Inferno drains are EVM (Ethereum-style) across about 28 chains, and are executed client-side. Its target list includes 165 tokens across 11 chains, heavily weighted toward stablecoins and liquid-staking tokens.

CONTEXTUAL NOTE: A stablecoin refers to cryptocurrency that is tied to a more stable external asset to keep the price fixed, usually a fiat currency like USD. Liquid staking tokens are derivative receipt tokens given to users who stake their crypto in a proof-of-stake blockchain. This allows a user to get liquidity while their staked assets keep getting rewards. This is where the liquid value is, and that is why it is prioritised by the threat actors involved.

Inferno Delivery Methods

The Inferno Drainer kit supports four methods of delivery.

The first is self-hosted phishing pages, meaning high-volume fake mints, airdrops, and claim pages.

Fig 18. Various examples of Inferno phishing templates [Source: PhishDestroy]

The second is the Cloudflare-Worker loaders, meaning the disposable, rotating edge of CF Workers.

Fig 19. CF Workers instructions from the Inferno affiliate panel.

The third is PHP relays, or affiliate loaders hosted on public GitHub repositories that resolve the live drainer domain at runtime by querying the on-chain command contract. For Inferno, this is the EVM affiliate arm. On-chain, the loaders which used this delivery method hardcode and call the EVM SecureProxy command contract, so these particular repositories deployed the EVM drainer, distinct from the separate on-chain Solana arm.

Fig 20. Affiliate panel screenshot detailing PHP relay instructions.

The last is the domain-layer takeover, which involves seizing a legitimate project's own front end, dispatched through a single drainer SDK with a weighted drain-method set (permit/permit2, Seaport/Blur and others). This last category encompasses what is probably the most infamous use of Inferno: the DNS hijack against the legitimate DeFi protocol curve[.]fi in May 2025. This compromise was done via a DNS hijack carried out at the registrar level, meaning the attackers controlled how the domain resolved and pointed Curve's trusted front end at drain code. Users who typed in the correct, bookmarked, genuine address of Curve were served the attack during this time.

Fig 21. Screenshot of the legitimate curve[.]fi domain, which was frozen temporarily following domain-layer takeover.

Fig 22. Screenshot of Curve's statement regarding the incident.

"cow[.]fi" Hijack (Domain Takeover Case Study)

In April 2026, the front end of the legitimate protocol cow[.]fi was hijacked, this time through a fraudulent dot-fi registry dispute. In this case, there was a fake ownership claim to the .fi registry Traficom that was backed by falsified identification of a CoW contributor and used to take control of the legitimate domain and redirect it to a drain.

This ran for approximately 4.5 hours before mitigation and led to losses of around $1.2 million USD according to public post-mortem.

On our team's end, WEDF's Head of Security was at a security event when the monitor for Inferno went off. Our team was able to see a massive spike in activity indicating large amounts of currency moving rapidly through the command pipeline, which represented the activity of the heist in progress. Our team was able to pull the live payload and deobfuscate it before the end of the attack, at which time we were able to see cow[.]fi struggle and eventually regain control of its own domain. This event was never officially attributed to Inferno Drainer outside of our observations.

Figs 23 & 24. Activity charts showing relative transactional spikes for both the day of the cow[.]fi heist as well as the specific time of day in which the heist occurred. These spikes represent Inferno asset drainage observed by WEDF's monitoring capabilities.

Part II: Inferno's Internal Structure

Affiliate Payments

In the past, many phishing kits cost a one-time fee for licensing use. However, like many legitimate software licensing structures today, AngelFerno operates using a recurring subscription fee, costing $1,000 USD per month until affiliates reach "Level 2" by successfully draining $10k cumulatively. The admins also offer occasional "tax free" periods to select users when new versions of the drainer are released in order to entice new affiliates.

Fig 25. Inferno affiliate interface within Telegram bot chat used to set up the individual's operator panel.

Fig 26. Update announcement sent from AngelFerno bot following a period of inactivity, announcing the initial client fee has been reduced to $300 USD.

Once an affiliate gets in contact with the Inferno admins via Telegram, they are instructed to make a group chat with the admin and an onboarding bot which handles setup and registration of the affiliate's payment address. The bot handles payouts and allows affiliates to quickly give commands and get the newest group ID, reset their password, list their sites, autoswap tokens, and more. There is also a separate bot for the AngelFerno EVM product and another for Solana and TRON. These operations were previously intended to be moved to an encrypted chat within the panel itself, but this functionality was moved.

Fig 27. Inferno affiliate interface within Telegram bot chat. "/info" automatically lists out the information above, unique to each affiliate's stats.

Affiliate Hierarchy

The affiliate split for Inferno is automatic and enforced in the software, with the operator skimming a variable percentage off the top of everything stolen. In this case, the operator takes an approximately 80/20 split on EVM drains and around 25/75 on Solana. However, the 80/20 split applies only to EVM drains under $5,000 USD.

For drains exceeding $5,000 USD, funds route 100% to the operator, bypassing the affiliate entirely. Just for initial access to the current build, an affiliate pays a one-time $300 USD tax (this number fluctuates, having initially been set at $1,000 USD). The payment structure is tiered like a loyalty programme, with the fee percentage shrinking for top performers (i.e. over the course of our research we saw a mid-tier account at 17.5%).

Revenue is split automatically on-chain when isAutoSplitEnabled is true, or routed to adminsNonSplittedHitsAddress for manual distribution. This means the wallet balances above reflect only the affiliate's operational costs (gas, domain registration), not the full proceeds of successful drains. Stolen assets flow directly to the drainerAddress and customerAddress via the drainer's own smart contracts on the victim's chain.

Affiliate Identifiers

Each affiliate has their own internal indicators for the operation to tag their activities. These include command-channel authentication tokens (permit keys) as well as customer identifiers which are unique to deployment and which were sourced from build configurations.

Affiliate Access Fees

Distinct from the victim-drain infrastructure above, these are operator revenue collection addresses that collect the affiliate's initial access fees (the fee to enter the current build version). Four different payment addresses were tracked by our team, each with a variable revenue volume. These payment addresses were each used for separate payment types:

On-chain Operator Wallet Cluster

• Treasury contract: Accumulates drained funds and disperses them (funded a deployer; bytecode-verified).
• Gas Dispenser: The primary drain executor, with 119,875 outbound transactions to date, active September 2023 to April 2026 (now dormant on Ethereum). A receipt-confirmed sample shows the majority are victim-sweep drains.
• Master Operator / Admin Key: The immutable Base-config administrator, verified to act as both a drain-execution relay as well as the authorised withdrawer of the treasury contract, active from July 2025 onwards.

Inferno's On-chain Command Configuration

Inferno's operators conceal its live command endpoints in on-chain contracts under encryption. We have reproduced two distinct cryptographic schemes (RSA and a ten-layer AES construction) across three contract systems, including the cross-chain bridge that links the operation's EVM and Solana arms. All three are reproduced from chain.

The operation's EVM command edge appears both as the value of the SecureProxy command contract (the EVM arm's command pointer) and as a slot in the multichain bridge. That shared value is on-chain proof that the EVM arm and the Solana arm are run through a singular operation. The operation's true architectural dependency is this on-chain configuration layer, which must publish the current command endpoint in order for the drainer to function at all.

Inferno Payload Deobfuscations

For our research, our team independently deobfuscated three generations of Inferno Drainer and compared them module by module. This included:

• The 2024 build (command endpoint apcnoo2[.]su)
• The 2025 (step19) build
  • The most sophisticated build, recovered to statement-level modules including the named drain-method modules for Seaport, Permit2, Blur, and ERC-20
• And a recent 2026 Cloudflare-Worker-edge build.

We found that the core drainer logic stays consistent across all three versions, with the six drain primitives consistent across every build examined:

• Seaport/Blur: Signed marketplace orders that transfer valuable NFTs or tokens for effectively nothing.
• Permit/Permit2: Off-chain signatures that grant spend rights with no on-chain transaction and no gas cost to the victim, making the request look innocuous.
• Approve/increaseAllowance: Standard ERC-20 mechanisms, set to a high or unlimited allowance so an attacker can withdraw at leisure after the fact.
• setApprovalForAll: Allows a single signature to surrender an entire NFT collection at once.
• Native sweep: A direct transfer of ETH or a chain's basecoin, which is executed the instant a signature is obtained for assets that do not require a prior approval step.
• Seed extraction: Value-thresholded and explicitly targeted at hardware-wallet users, specifically Ledger and Trezor holders, tricking them into exposing their recovery phrase directly.

The only layer that changed across the generations is the command-and-control transport, which was as follows:

• 2024: Static domain
• 2025: On-chain-config resolution
• 2026: Daily-rotating Cloudflare Worker edge

In order to do this, our team had to unravel a complex anti-forensic stack which included a Function-bytecode outer packer, custom-name obfuscation, deliberate length-traps, and AES-encrypted strings. Underneath all of this are the string table, TTPs, and the target list.

Part III: Inferno Enshittification (Signs of Operational Decline)

Inferno is still actively draining wallets as of summer 2026, but from our perspective has experienced massive operational decline since its peak and is visibly decaying. Technical indicators we have observed over the course of our research indicate an admin team which neither fully understands nor actively maintains its own product.

Admin-key Asymmetry & Lockout

There are numerous signs that the current operators of Inferno are far less competent than their predecessors.

The standout observation comes due to a function of the drainer's key rotation which is a major structural weakness. The Base configuration contract has no administrator-change function and an immutable admin set in storage, so when the operators rotated to a new signing key in May 2026, every configuration transaction reverted, resulting in the admins bricking their own command contract and locking themselves out of their own infrastructure for 23 days (May 2 – May 24) until it reverted to the original key.

This is because the operator had no in-place way of changing the controlling key due to key loss or compromise, barring a full contract redeployment and rebuild of every affiliate loader.

This string of failed transactions, as the operators struggled to regain control of their operations, are all still publicly available on-chain, showing as a run of daily reverts followed by a recovery.

Figs 28 & 29. BaseScan transaction history showing reverts due to a "Not admin" error at the beginning of the admin self-lockout period on May 02, 2026 and continuing until May 25.

2026 Build Wrapper

Fig 30. Build comparison infographic.

The 2024 build for Inferno resolved a static, hardcoded command domain. As far as builds go, this one was both simple to build and, in theory, simple to kill: seize the one domain and every deployment pointing at it goes dark.

The 2025 build moved its command resolution on-chain. The payload reads a smart contract at runtime to learn its current destination. This makes mitigation much harder, because you cannot seize a contract the way you seize a domain. It lives on a public, censorship-resistant ledger, and it will continue to answer queries ad infinitum.

It is by far the most sophisticated of the Inferno builds analysed, and was broken down by WEDF to statement-level modules, including the named drain-method modules for Seaport, Permit2, Blur, and ERC-20. To our knowledge, this qualifies as the first complete deobfuscation of an Inferno-v2 payload.

The 2026 build resolves a rotating Cloudflare Worker edge which consistently replaces the address. However, this transport is the only truly new addition. This indicates that the most recent 2026 build is, in effect, merely a re-packed wrapper around the 2025 build, with drain mechanics and on-chain command-resolution backbone (SecureProxy PHP-relay command pointer → C2 endpoint) preserved, with only a novel served edge and rotation cadence. In short, what actually keeps getting re-engineered is only the command transport (how a deployed payload finds out where to call home). That is more akin to paying lip service to maintenance than a skilled developer team evolving its own creation.

In general, over the course of monitoring Inferno, WEDF has seen the sprawling, multi-variant, multi-chain operation with affiliate numbers in the thousands show significantly reduced literacy about its own codebase, even as numbers remain high, presumably from legacy alone.

Conclusion

Admins of phishing kits, whether they are the original developers or not, are still responsible for hosting and updating the kit, maintaining the panel and command infrastructure, and communicating constantly with affiliates and operators. Historically, affiliate:admin ratios have been split at around 70/30, but have recently trended towards around 80/20, with some even advertising higher.

As with most shifts in the threat ecosystem, this likely stems from the convergence of multiple trends and individual factors, but one likely contributor is that the affiliate ratio has an inverse relationship to the level of organisation and effort expected from the kit admins. Entry thresholds for technical skill and experience have gradually lowered over time for prospective threat actors as the creation of configurable, user-friendly and effective kits has become more streamlined.

There are more kits floating around than ever, meaning more options, meaning new affiliates want more bang for their buck, incentivising kit admins to heighten affiliate payout ratios. However, realistically, a talented DaaS developer is not going to want to continue to handle infrastructural improvements and product maintenance for a kit which is only paying them a fraction of the revenue. It is simply easier for them to make an initial product and sell to someone less talented than they are who cannot create a product on their own.

These buyers may be far less competent and lack the technical and organisational skills to properly update the payload, address affiliate feedback or even continue to run the operations diligently. After all, having no personal attachment to the product themselves, they can simply do the absolute minimum until they feel they have earned enough of a profit to simply pull an exit scam and disappear into the ether.

Inferno Drainer was, at one point at least, likely the most sophisticated and effective DaaS on the market. Now it is more of a farm upstate where other drainers are sent once they are past their prime, where they can be grafted onto the increasingly messy Inferno brand: a brand which continues to market itself as ever-growing and evolving to unsuspecting new affiliates, unaware that leadership already has one foot out the door.

Fig 31. Inferno's panel domain currently advertising a new "high-performance deployment and orchestration engine" to be released in 2027 with an active countdown clock. Be sure to join their email waitlist!