Search





Search





NewsCryptocurrencies

StepDrainer drains crypto wallets across +20 networks

CryptopolitanApr 30, 2026 11:34 PM

View all comments（0）



A crypto-stealing tool called StepDrainer is draining money from wallets across Ethereum, BNB Chain, Arbitrum, Polygon, and at least 17 other networks.

StepDrainer operates as a malware-as-a-service kit. It uses fake but realistic Web3 wallet pop-ups to trick people into approving transfers. Some of those screens are made to look like Web3Modal wallet connections.

Once someone connects their wallet, StepDrainer looks for the most valuable tokens first and automatically sends them to wallets controlled by the attackers, according to LevelBlue.

StepDrainer misuses smart contract tools

StepDrainer misuses real smart contract tools like Seaport and Permit v2 to show wallet approval pop-ups that look normal. But the details inside those pop-ups are fake.

In one case, cybersecurity researchers found that victims saw a fake message saying they were receiving “ 500 USDT,” making the approval look safe.

StepDrainer loads its harmful code through changing scripts and gets its setup from decentralized on-chain accounts.

That setup helps the attackers dodge normal security tools because the harmful code is not stored in one fixed place where it can be easily scanned.

StepDrainer is not just one person’s project. Researchers said there is a developed underground market selling ready-made drainer kits, making it easier for many attackers to add wallet-stealing features to scams they already run.

EtherRAT siphons crypto from Windows users

Researchers also found another malware besides StepDrainer, called EtherRAT. It targets Windows through a fake version of the Tftpd64 network admin tool.

According to LevelBlue, EtherRAT hides Node.js inside a fake installer, makes sure it stays on the computer through the Windows registry, and uses PowerShell to check the system.

EtherRAT first targeted Linux. Now it is bringing malware tricks and crypto theft to Windows.

EtherRAT quietly runs in the background. It checks things like antivirus tools, system settings, domain details, and hardware before it starts stealing.

According to a recent Cryptopolitan report, over 500 Ethereum wallets have been drained in the past 24 hours. The attacker siphoned more than $800K in crypto assets and then swapped the funds via ThorChain.

Many of the drained wallets have been inactive for over 7 years, according to on-chain research Wazz. The drained funds were directed by a single wallet address controlled by the attacker.

Cybersecurity researchers advise users connecting wallets to unknown sites to verify the domain, read the transaction details before signing, and remove any unlimited token approvals.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.

Disclaimer: The information provided on this website is for educational and informational purposes only and should not be considered financial or investment advice.

Comments (0)

Click the $ button, enter the symbol, and select to link a stock, ETF, or other ticker.

Commenting Guidelines

Recommended Articles

S&P 500 Index Forecast: Meta, Microsoft, Alphabet and Other Companies Continue Increasing AI Investment, May Support Index Surpassing 8,000 in Second Half of 2026

TradingKey - The S&P 500 index has recently experienced volatility at high levels. As of the U.S. market close on July 16, the S&P 500 index stood at 7,533.77 points, falling 0.51% on the day. Despite the short-term pullback, technical indicators suggest the medium-to-long-term bullish trend remains intact, and institutions continue to hold a positive outlook for the future of the S&P 500.

Apple Hits Record High, Market Cap Surges to $4.9 Trillion: Why Full-Year Gains Lead the Mag 7?

TradingKey - Against the backdrop of a general pullback in the AI sector, Apple (AAPL) has staged an independent rally, driven by its unique ecosystem moat and robust financial performance. After reaching an all-time high of $323.45 on July 13, the share price hit another record high of $327.5 on July 15. Its market capitalization currently stands at $4.81 trillion, making it the second-largest company in the U.S. by market value as it approaches the epic $5 trillion milestone, trailing only Nvidia (NVDA) at $5.13 trillion. In fact, Apple's year-to-date gain in 2026 has reached 16%, also leading the "Mag 7."

SpaceX Negotiates Multi-Billion Dollar Computing Power Deal With Pentagon: Stock Price Drop Does Not Change Wall Street’s Bullish Expectations

Tradingkey - The Wall Street Journal reported that SpaceX (SPCX) is in negotiations with the U.S. Department of Defense to sell computing power. The deal could be valued at billions of dollars, and if finalized, would mark the latest major infrastructure contract for Elon Musk’s integrated rocket, satellite, and artificial intelligence conglomerate. The report noted that the partnership model for this deal is similar to previous agreements SpaceX reached with Alphabet’s Google (GOOGL) and AI firm Anthropic. The negotiations come as the U.S. military seeks to construct data centers within its military bases to bolster its autonomous computing capabilities.

Meta Plans to Lease Computing Power to Anthropic: Shares Surge Back to $650, Cloud Computing Commercialization Layout Sees Substantial Progress

TradingKey - Meta Platforms (META) has made substantial progress in the commercialization of its cloud computing infrastructure. According to media reports, Meta is in early-stage talks with leading AI company Anthropic to lease computing resources from its proprietary data centers, a two-year partnership that could be worth up to $10 billion. If finalized, the deal would represent a landmark transaction, marking Meta's transition from using its computing assets solely for internal operations to external commercialization. Driven by the news, Meta's stock price recovered significantly, narrowing from an early-session decline of over 5% to less than 2%. As of press time, shares were down 2.06% at $650.82.

US-Iran Conflict Escalates, International Oil Prices Surge Over 3%: WTI Crude Breaks $81, Strait of Hormuz Shipping Blocked

Tradingkey - On July 17 (ET), as the conflict between the U.S. and Iran continued to escalate, the two major crude oil futures rose again, returning to price levels seen in mid-June. As of press time, WTI crude futures rose over 3% to $81.05, while Brent crude futures also gained more than 3% to $87.01. The confrontation between the two sides has intensified as the fragile ceasefire agreement signed by the U.S. and Iran last month shows further signs of breaking down.

Featured Tools