New scam service Vanilla Drainer takes $5M in three weeks

2025-08-27 17:11:35 Primitive Reading

A blockchain investigator has attributed at least $5.27 million in crypto stolen over three weeks to a rising scam service known as Vanilla Drainer.

Drainers are entities that provide scam software to fraudsters, often paired with phishing tactics to access victims’ funds. Vanilla is part of a new generation of these groups and has largely flown under the radar, but recent high-value thefts have drawn attention from blockchain sleuths.

Draining scams peaked in 2024, when victims lost almost $500 million to top services, such as Angel, Inferno and Pink, according to Scam Sniffer. Draining still occurs frequently, though volumes have dropped due to new security technologies. However, blockchain investigator Darkbit warns that drainers are adapting.

“I see [Vanilla] taking over many Inferno customers,” Darkbit told Cointelegraph. “Most of the large six- and seven-figure drains of late can be attributed to Vanilla Drainer.”

A simplified fund flow sample of a Vanilla scam trail shows a 15%-20% cut for the drainer provider. Source: Darkbit

One victim lost $3 million in crypto to Vanilla Drainer

Earlier Vanilla thefts can be traced back to October 2024, but its earliest known public advertisement was posted on Dec. 8, 2024, though it has since become inaccessible. The ad claimed Vanilla could bypass Blockaid, a fraud detection platform often cited by drainers as a major factor behind declining proceeds and, in some cases, their shutdown.

A December Vanilla advert promises an “advanced algorithm” to avoid Blockaid detection. Source: Vanilla Drainer/Carder Market

The service starts with a 20% cut of scam proceeds for the drainer provider, which is considered the standard split in the draining world. According to Vanilla’s advert, the percentage could drop for larger hauls.

The largest theft attributed to Vanilla occurred on Aug. 5, when a victim lost $3.09 million in stablecoins. In this case, Vanilla’s operators appear to have received a $463,000 fee for providing the tools, or about 17% of the stolen funds.

Vanilla operators received a $463,000 cut from their largest known haul. Source: Darkbit

Once the split is taken, Vanilla typically converts tokens into the blockchain’s native cryptocurrency, like Ether , before transferring them to a final fee wallet (0x9d3…E710d), where most of the scam fees are parked, according to Darkbit. Around $1.6 million in this wallet has been converted to DaiDAI$0.9998, a decentralized stablecoin pegged to the US dollar that cannot be frozen like its centralized counterparts, USDtUSDT$0.9999or USDCUSDC$0.9998. At the time of writing, the wallet held $2.23 million in tokens, mostly in DAI and ETH.

Disclaimer: This specification is preliminary and is subject to change at any time without notice. Amazon Finance assumes no responsibility for any errors contained herein.