Cybersecurity News in Asia

RECENT STORIES:

SEGA moves faster with flow-based network monitoring
Vietnam Launches NDAChain, the National Blockchain Platform to Acceler...
Elitery a Pioneering MSSP Partner for Google Cloud’s “Indo...
Asia Pacific’s Mobile Sector Adds $950 Billion to GDP; On Track ...
PT Kereta Api Indonesia announces nationwide email and communication o...
Will governments assert stronger oversight over tech giants deemed as ...
LOGIN REGISTER
CybersecAsia
  • Features
    • Featured

      The rising threats and business risks of machine identities

      The rising threats and business risks of machine identities

      Tuesday, July 22, 2025, 12:19 PM Asia/Singapore | Features, IoT Security
    • Featured

      The future of AI-powered cybersecurity

      The future of AI-powered cybersecurity

      Monday, July 21, 2025, 4:04 PM Asia/Singapore | Features, Newsletter, Tips
    • Featured

      Transcending digital disruption: How financial institutions can integrate innovation, security, and agility

      Transcending digital disruption: How financial institutions can integrate innovation, security, and agility

      Thursday, July 10, 2025, 4:16 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning

Select Page

LOGIN REGISTER
  • Features
    • Featured

      The rising threats and business risks of machine identities

      The rising threats and business risks of machine identities

      Tuesday, July 22, 2025, 12:19 PM Asia/Singapore | Features, IoT Security
    • Featured

      The future of AI-powered cybersecurity

      The future of AI-powered cybersecurity

      Monday, July 21, 2025, 4:04 PM Asia/Singapore | Features, Newsletter, Tips
    • Featured

      Transcending digital disruption: How financial institutions can integrate innovation, security, and agility

      Transcending digital disruption: How financial institutions can integrate innovation, security, and agility

      Thursday, July 10, 2025, 4:16 PM Asia/Singapore | Features
  • Opinions
  • Tips
  • Whitepapers
  • Awards 2025
  • Directory
  • E-Learning
News

Sophisticated crypto theft operation exploits phishing, smart contracts to steal millions

By CybersecAsia editors | Monday, May 26, 2025, 5:40 PM Asia/Singapore

Sophisticated crypto theft operation exploits phishing, smart contracts to steal millions

A new cybercrime campaign uses advanced phishing, obfuscated scripts, and malicious smart contracts to steal millions from unsuspecting cryptocurrency wallet holders.

According to the latest threat intelligence, a new wave of cryptocurrency thefts is being driven by a highly organized cybercrime operation calling itself Inferno Drainer that has refined the “Drainer-as-a-Service” model after claiming to exit the scene in November 2023.

This operation supplies cybercriminals with a toolkit of malicious scripts, smart contracts, and supporting infrastructure, enabling even low-skilled attackers to efficiently steal (or “drain”) digital assets from unsuspecting users’ wallets.

The attack chain typically begins with sophisticated phishing campaigns, often targeting members of crypto communities on platforms such as Discord. Then:

  • Attackers hijack expired vanity invite links or create fake bots that mimic trusted services, such as token-gated access management bots.
  • Once users are lured to these malicious servers, they are prompted to connect their wallets and sign seemingly legitimate transactions.
  • The phishing sites are convincing, closely imitating real interfaces and even displaying the user’s actual Discord credentials to lower suspicion.
  • The underlying malicious scripts are heavily obfuscated, employing multiple layers of string manipulation, dynamic function calls, and anti-debugging techniques to evade detection and analysis. Each phishing site receives a unique, frequently updated script, complicating automated discovery and takedown efforts.
  • A key innovation of this threat is its use of blockchain infrastructure to store critical configuration data and command server addresses. Rather than hardcoding these details, the scripts retrieve them from smart contracts on blockchains, using encrypted and encoded data that is difficult for defenders to analyze.
  • Communication with command servers is further shielded through rapidly rotating proxy servers and domains, often leveraging reputable platforms to avoid blacklisting.
  • The crypto theft itself is executed through a series of smart contracts that mimic legitimate token contracts but contain hidden logic. These contracts drain funds by exploiting wallet permissions or by prompting direct transfers. To bypass wallet security and blacklists, attackers employ short-lived contracts and frequently rotate receiving addresses. In some cases, tokens are sent to precomputed contract addresses that do not yet exist on-chain, making detection nearly impossible until after the theft occurs.

According to Eli Smadja, Group Manager, Check Point Research, the firm sharing its threat intelligence, over the past six months, this crypto threat operation has victimized more than 30,000 users, resulting in losses exceeding US$9m. The scale, technical sophistication, and relentless adaptation of tactics highlight the evolving threat landscape for cryptocurrency users.

Share:

PreviousRicoh IM C3010 Wins 2025 Pick Award from Keypoint Intelligence
NextHow to outsmart filename masquerading: A practical guide to safer file handling

Related Posts

Countering unauthorized drone activity with advanced alerting functionality

Countering unauthorized drone activity with advanced alerting functionality

Thursday, June 11, 2020

Massively powerful botnet spotted: 5G-boosted DDoS attacks on the horizon

Massively powerful botnet spotted: 5G-boosted DDoS attacks on the horizon

Friday, September 10, 2021

Ransomware recovery costs hit US.62m in mid-sized APJ financial services firms

Ransomware recovery costs hit US$2.62m in mid-sized APJ financial services firms

Friday, September 17, 2021

Scholarship program aims to boost cybersecurity talent pool in Singapore

Scholarship program aims to boost cybersecurity talent pool in Singapore

Wednesday, February 10, 2021

Leave a reply Cancel reply

You must be logged in to post a comment.

Voters-draw/RCA-Sponsors

Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
Slide
previous arrow
next arrow

CybersecAsia Voting Placement

Gamification listing or Participate Now

PARTICIPATE NOW

Vote Now -Placement(Google Ads)

Top-Sidebar-banner

Whitepapers

  • 2024 Insider Threat Report: Trends, Challenges, and Solutions

    2024 Insider Threat Report: Trends, Challenges, and Solutions

    Insider threats continue to be a major cybersecurity risk in 2024. Explore more insights on …Download Whitepaper
  • AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    AI-Powered Cyber Ops: Redefining Cloud Security for 2025

    The future of cybersecurity is a perfect storm: AI-driven attacks, cloud expansion, and the convergence …Download Whitepaper
  • Data Management in the Age of Cloud and AI

    Data Management in the Age of Cloud and AI

    In today’s Asia Pacific business environment, organizations are leaning on hybrid multi-cloud infrastructures and advanced …Download Whitepaper
  • Mitigating Ransomware Risks with GRC Automation

    Mitigating Ransomware Risks with GRC Automation

    In today’s landscape, ransomware attacks pose significant threats to organizations of all sizes, with increasing …Download Whitepaper

Middle-sidebar-banner

Case Studies

  • Operationalizing sustainability in cybersecurity: Group-IB’s approach

    Operationalizing sustainability in cybersecurity: Group-IB’s approach

    See how the firm turned malware-group takedowns into measurements of sustainability and resilience gains: by …Read more
  • Thai government expands secure email management to close cybersecurity gaps

    Thai government expands secure email management to close cybersecurity gaps

    New measures address cybersecurity gaps in public sector communications, deploying advanced protections and operational support …Read more
  • How Iress optimized global DevSecOps

    How Iress optimized global DevSecOps

    Scaling compliance, security & efficiency – while seamlessly migrating to the cloud – with JFrog.Read more
  • St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    St Luke’s ElderCare enhances operations and capabilities through a centralized secure, scalable network

    With only a small IT team, the digital transformation has united operations across 30 locations, …Read more

Bottom sidebar

  • Our Brands
  • DigiconAsia
  • MartechAsia
  • Home
  • About Us
  • Contact Us
  • Sitemap
  • Privacy & Cookies
  • Terms of Use
  • Advertising & Reprint Policy
  • Media Kit
  • Subscribe
  • Manage Subscriptions
  • Newsletter

Copyright © 2025 CybersecAsia All Rights Reserved.