• A new wallet-draining group called Eleven Drainer has surfaced, adding to the surge of organized phishing-as-a-service operations.
• Researchers at blockchain security firm SowMist say the phishing group is rapidly expanding its reach and refining its techniques.
• Despite their sophistication, security specialists in the industry stress that most crypto phishing incidents still stem from user errors.

A new wallet-draining scheme has emerged in the crypto underground, intensifying pressure on an ecosystem already dealing with an unrelenting wave of phishing attacks.

On November 9, SlowMist founder Yu Xian said his team had identified a growing cluster of victims linked to a group known as Eleven Drainer.

Eleven Drainer Emergence Exposes Rising Fragility in Crypto Security

Xian noted that this is a new crypto phishing-as-a-service outfit that has become increasingly active in recent weeks.

Sponsored

Sponsored

His remarks indicate that the operators are expanding their reach and adjusting their techniques. This shift has prompted SlowMist researchers to examine whether the group has introduced more advanced exploitation methods.

Meanwhile, Eleven Drainer joins a crowded landscape of professionalized draining service providers, such as Angel and Inferno Drainer.

Over the past years, the sector has flourished because it allows scammers to run large-scale malicious operations with minimal effort.

These kits provide everything a fraudster needs, including cloned websites, deceptive social media accounts, smart contract scripts, and automated workflows. In exchange, operators take a percentage of the stolen funds.

As a result, these malicious actors have become the backbone of modern crypto phishing campaigns. In 2024, drainers were responsible for an estimated $494 million in losses, a 67% jump from the previous year.

However, despite the increasing sophistication of these groups, security specialists emphasize that user behavior remains the weakest point in most incidents.

According to them, these attackers rely on hurried decisions and misleading prompts. They also employ social-engineering tactics that convince users to sign away assets without noticing the warning signs.

Xian emphasized this reality, noting that there is “nothing much worth mentioning regarding defense” beyond disciplined online behavior.

His guidance follows a clear logic of always avoiding unfamiliar websites, examining every wallet signature request, and refusing to approve transactions under pressure.

Disclaimer