A new crypto scam tool called Vanilla Drainer has emerged as one of the most active players in blockchain crime, stealing more than $5.27 million in just three weeks, according to blockchain investigator Darkbit.
Drainers are scam services that provide fraudsters with software to steal funds, often paired with phishing websites designed to trick victims into giving wallet access. Vanilla has quickly gained traction in 2025, with Darkbit noting that “most of the large six- and seven-figure drains of late can be attributed to Vanilla Drainer.”
Crypto draining scams peaked in 2024, costing victims nearly $500 million through top services such as Angel, Inferno and Pink, according to Scam Sniffer. Volumes have since declined due to better security tools, but Vanilla appears to be filling the gap with new tactics.
The largest known theft linked to Vanilla occurred on August 5, when a victim lost $3.09 million in stablecoins. Vanilla’s operators reportedly pocketed $463,000 in fees from the job. Investigators say the service typically takes a 20% cut of each scam, with proceeds converted into Ether or Dai before being sent to a main “fee wallet.” That wallet currently holds around $2.23 million, mostly in DAI and ETH.
Vanilla has been linked to several other six-figure scams in July, including one incident where a victim lost $1.23 million. In total, Vanilla is tied to at least $5.27 million stolen between mid-July and early August.
Darkbit says Vanilla’s operators remain highly agile by cycling through domains and deploying fresh malicious contracts for each phishing site, making detection more difficult.
Although Inferno Drainer claimed to shut down in late 2023, it resurfaced multiple times, eventually passing operations to Angel Drainer. Similar patterns suggest that even if Vanilla eventually “closes,” its tools will likely persist under new names.
For now, Vanilla’s rise shows that drainer services remain a stubborn threat to crypto investors, even as the broader scam economy shrinks.
