A colleague dropped a screenshot into our security channel last Tuesday. It was a MistEye dashboard — SlowMist's automated threat-hunting system — and the counter read 1,500+.
One thousand five hundred live phishing sites. Not historical. Not "detected over the past quarter." Live, right now, serving pages to whoever lands on them.
I have been at this long enough that raw numbers rarely move me. In 2020 I sat with 150 Uniswap V2 pool contracts spread across three monitors, teaching myself to read reserve ratios the way you read handwriting — hunting for the tell, the small deviation that says someone made a mistake. Numbers are just inventory. But this one bothered me, and not because of scale.
The report contained no IOCs.
No sample domains. No drainer consolidation addresses. No malicious JavaScript hashes. No contract addresses. Nothing a wallet provider could push to a blocklist before the end of the business day.
A threat warning you cannot act on is a press release with a timestamp. That, far more than the 1,500, is the story worth writing about.
The Context We Keep Skipping
Phishing-as-a-Service is not a new concept, but it has quietly completed a transition that most of the industry has not metabolised. It went from craft to manufacturing.
Single-operator phishing sites live for hours to days. They get flagged, they get taken down, the operator rebuilds by hand. What MistEye observed is something structurally different: a persistent inventory in the four figures. You do not maintain that with a laptop and a grudge. You maintain it with templates, batch domain registration, bulletproof hosting, a distribution channel, and a support tier.
That is a product. DarkSword is, in all likelihood, a product name rather than a person — and possibly not even the attacker's own naming, since security firms routinely assign codenames to kits that never named themselves. The distinction matters, because it changes who you are actually chasing.
The target list is the most interesting artefact in the whole disclosure, and it is the only real profile data we have. E-commerce. Exchanges. Wallets. Games. Read that order again. E-commerce sits at the front, and e-commerce is not a crypto-native category. Which suggests either the kit is being sold into non-crypto criminal crews, or the operators have discovered crypto-payment checkout pages as a soft entry point into conventional retail. Either reading points the same direction: the attack surface has already spilled outside the crypto perimeter.
The market structure behind this is what I would call oligarch rotation plus long tail. Pink Drainer publicly retired in 2024. Inferno Drainer announced a shutdown in late 2023 and then appeared to return under new branding. Every time a dominant kit gets too visible, it exits, the demand does not evaporate, and the share redistributes to whoever is next plus a swarm of cheap clones. Total volume barely moves. It is whack-a-mole with a business plan.
And note the market backdrop we are sitting in. Sideways chop is where security budgets get quietly trimmed and where the underground consolidates its tooling. Nobody panic-buys protection in a flat tape. They panic-buy it after the loss.
The Number Is an Economic Signal
Here is the reframe I want to plant, because I think the reflexive reading is wrong.
When a security firm reports 1,500 live phishing sites, the instinct is to read it as a failure of defence. I read it as evidence of a healthy attacker unit economics model. Nobody sustains an operation at that scale at a loss. The inventory is a profit statement.
The value chain has four layers, and the margin distribution is the whole story. The kit developer collects a subscription fee or a one-time sale — fixed revenue, zero contact with stolen funds, therefore the lowest legal exposure in the entire chain. The affiliate or traffic distributor takes a per-victim or per-value cut. The wallet drainer operator takes the largest slice of the actual theft, in the rough range of 20 to 30 percent on industry reporting I would want independently verified. The cash-out layer — OTC desks, mixers, P2P — takes somewhere between 5 and 15 percent. And underneath all of it, the domain registrars and bulletproof hosting providers collect flat fees, because they are the utilities of this economy.
Sell the shovel, never touch the gold. That is the position DarkSword almost certainly occupies, and it explains the longevity. Compare it to the drainer operators who have to move funds on-chain and leave a trail. The kit vendor leaves a template and a Telegram channel.
Which tells you where the leverage is. It is not with the attacker.
It is with the infrastructure. Every single layer of this chain depends on somebody in the legitimate economy deciding not to look too closely — the registrar that takes a bulk order of 400 lookalike domains, the CDN that reverse-proxies a malicious origin behind a clean edge, the messaging platform that hosts the distribution channel, the payment processor that clears the subscription. Apply pressure there and the scaling capability does not degrade gradually. It falls off a cliff. Pursue the operator and you get a headline; pursue the registrar and you get a supply constraint.
Root: We Shipped a One-Click Loss Button
Now the part that actually keeps me up, and the part the disclosure did not touch because it was never meant to be a technical teardown.
Modern drainers do not break cryptography. They do not need to. They exploit the single primitive we designed to be frictionless: the token approval.
Here is the mechanism, stripped of jargon. An ERC-20 approval is you telling the contract, in effect, "this address may move up to N of my tokens." Set N to the maximum and you have handed over an open-ended, revocable-only-by-you mandate. Permit and Permit2 pushed this further — they moved approvals off-chain into signed messages, which was a genuine UX victory because it meant you could authorise without paying gas. Cheaper, faster, smoother.
And gasless signing removed the last hesitation in the loop. When a signature costs nothing, there is no moment of friction where a cautious person stops and thinks. We optimised away the only natural pause in the flow, and we called it progress.
The signature is the last human checkpoint in the entire stack. Everything upstream — private key generation, seed phrase hygiene, hardware isolation — protects a secret. But the asset does not leave through the secret. It leaves through consent. And we render that consent as a modal dialog with a hex address and a number too long to read.
— Root: we built a system whose security boundary is a dialog box, then made the dialog box unreadable, then removed the cost of clicking it.
I learned this the hard way, in a good way, during the 2022 winter. I spent six months patching legacy bugs in Gnosis Safe's multisig codebase — 40-plus commits, mostly unglamorous. What that work taught me is that real security lives in boring infrastructure, not in clever cryptography. The multisig does not fail because the curve is weak. It fails because the threshold was set to 2-of-3 with two keys on the same laptop.
Same pattern here. The chain is fine. The interface betrayed it.
And 1,500 is a floor, not a ceiling. Any kit operating at this scale runs cloaking — returning benign content to security crawlers, serving the payload only to fingerprint-matched human traffic. MistEye's 1,500 are the sites that were either undefended or had a broken cloaking configuration. The real inventory is larger, and the gap between observed and actual is the attacker's safety margin.
Which brings me to the tax nobody invoices. When a user gets drained by a Binance or OKX lookalike, the exchange is not legally liable — the user clicked, the user signed, the funds left. But commercially the exchange pays anyway: brand protection teams, takedown coordination, customer support hours, goodwill reimbursements, the reputational drag of every screenshot. The legitimate Web3 industry is paying a recurring, unbilled tax to an underground economy it does not transact with. Nobody books that line item. It is buried in opex and called "security."
I keep coming back to something I said during my podcast years — back when I was mining for truth in the noise of NFT mania, interviewing 30 creators for The Digital Soul and watching a single episode pull 50,000 downloads in a week before the whole thing curdled. The lesson from that cycle holds exactly here. Hype economies and threat economies share a structure: the noise grows faster than the signal, and the people closest to the money are the last to ask what is actually being sold.
The Contrarian Read: This Is Our Architecture, Not Their Cunning
The comfortable narrative is that sophisticated criminals are outsmarting naive users. I do not buy it, and the reason is institutional.
Last year I spent most of my working hours negotiating a trust-layer framework with three EU banks for custody arrangements. I want to be precise about what those conversations were actually about, because it reframes everything. Not one of them would have accepted "a single user gesture results in irreversible, total, unrecoverable loss" as a product design. Not one. That is not a security posture they would sign off on, because it is not a security posture at all — it is a liability transfer dressed as user sovereignty.
We didn't build a trust layer. We built a signature prompt and then wrote a philosophy around it.
"Not your keys, not your coins" is a correct and important principle. But we silently appended a second clause that nobody agreed to: not your recourse. And the entire drainer industry is, functionally, an arbitrage on that unexamined clause.
The second uncomfortable thing is about us — the security side. There is a structural incentive to publish fear without actionable specifics. Not malice. Incentive. A disclosure with no IOCs generates awareness, drives installations of protective tooling, and elevates the publisher's profile, while committing to nothing falsifiable. The moment you publish domains and wallet clusters, you can be graded. Fear is a better product than a blocklist, commercially speaking. I say this as someone who respects SlowMist's track record enormously — the sourcing here is genuinely strong, and an automated scanner is far less likely to inflate than a human tipster. Strong source, incomplete artefact. Both things are true.
And the third: "educate users" is not a security strategy. It is architectural debt transferred onto individuals who never signed up to be the last line of defence. Every phishing-awareness campaign is an admission that the consent layer failed.
There is one genuinely hopeful angle hiding in the target list, though. E-commerce at the top means this kit is going after people with no crypto literacy at all — and those people have chargeback departments, consumer protection regulators, and payment networks that treat fraud losses as an existential problem. Crypto users are the most battle-hardened, scam-literate population in finance. Shopify customers are not. When the losses migrate into that population, the regulatory response will not come from crypto policy. It will come from consumer protection, and it will be far less patient with us.
The cavalry is not coming from inside the industry.
What a Real Trust Layer Would Require
So here is where I land, and it is not a takedown target list.
The next cycle will produce 10,000 sites, not 1,500, because the marginal cost of one more phishing page is approaching zero and the marginal cost of one more security takedown is not. Open source is not a license; it's a state of mind — and in the underground, that state of mind has always been "someone else's leaked code, my revenue stream." Leaked kits get forked, resold, rebranded. You cannot starve that by winning a race to delete domains.
What you can do is make the signature mean something. Session-scoped and amount-bounded approvals by default. Human-readable intent rendered in the wallet — not an address, a sentence. Revocation as a first-class primitive surfaced in the same place the approval was granted. Pooled loss structures so that one click is not a life sentence. Liquidity isn't the constraint here; consent architecture is.
The question for the next two years is not whether we can take down 1,500 sites faster than they can spin up 1,500 more. We cannot, and pretending otherwise is how we ended up shipping a hex string and calling it informed consent. The real question is whether, by the time the count reaches five figures, we will still be asking users to read a hash and hope — or whether we will finally treat the signature prompt as the trust layer it was always supposed to be.
Everything else is noise. And I have no interest in mining noise.