TRC20 Drainer + AML Project + QR Method Offered as a 3-in-1 Crypto Theft Kit
A forum actor using the handle "honeymanOne" is advertising a private cryptocurrency theft kit combining a TRC20 drainer, a fake AML-check workflow and a QR-based wallet-draining component. The seller describes the package as a single platform with a Telegram-bot administration layer and claims support for multiple networks and wallets. According to the post, the kit is designed to imitate legitimate wallet-compliance and wallet-connection flows in order to obtain transaction approvals from victims, while the QR component is presented as a fake wallet interface. The listing also advertises operator notifications, wallet and balance telemetry, configurable withdrawal behavior, source code and setup support. The asking price shown in the post is $3,000. These are seller claims and have not been independently verified.
▣Post details
!What the post claims
- TRC20 wallet-draining component
- Fake AML-check workflow
- QR-based wallet-draining component
- Single administration panel
- Telegram-bot administration
- Wallet and balance notifications
- Victim IP and location telemetry
- Transaction and approval notifications
- Support for multiple token networks
- Support for multiple wallet brands
- Custom-branded AML landing pages
- Fake wallet-check interface
- QR-based wallet connection flow
- Light and dark interface themes
- Configurable withdrawal behavior
- Operator-controlled token approvals
- Desktop and mobile support claimed
- WalletConnect integration claimed
- Source code included
- Setup assistance and documentation claimed
◱Screenshots
☷Mapped techniques
The mappings below are based on the seller's description of the product's intended behavior and user interaction. They describe the advertised capabilities at a high level and are not independent confirmation that the tool functions as claimed.
- Credential Access / CollectionT1056Input CaptureClaimedThe seller describes deceptive wallet and AML-check interfaces designed to induce victims to interact with attacker-controlled approval and connection flows.
- Initial AccessT1566PhishingInferredThe advertised AML and wallet-check pages are presented as social-engineering lures intended to convince users that they are interacting with legitimate compliance or wallet services.
⚠Potential impact
If the advertised capabilities are genuine, the kit could be used to steal cryptocurrency by tricking victims into authorizing malicious wallet actions. The fake AML and wallet-check branding may increase credibility by presenting the activity as a compliance or security process, while the QR component can make the flow resemble a legitimate wallet connection. Support for multiple networks, wallet brands and operator notifications could make the kit adaptable across different campaigns and increase the number of potential victims.
iStatus Unverified
The forum listing contains detailed marketing claims, screenshots of wallet-themed interfaces and a stated sale price of $3,000. The seller claims the product was previously private and has been used on real traffic, but Dark Web Informer has not independently verified the malware's functionality, success rate, supported networks, wallet compatibility or the seller's claims regarding source code and operational history.
Dark Web Informer // Threat Intelligence
