# cryptocurrency theft

Published articles for cryptocurrency theft.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## When a Wallet Drainer Asks DNS Where to Go

DevFeed: [When a Wallet Drainer Asks DNS Where to Go](<https://devfeed.tech/articles/when-a-wallet-drainer-asks-dns-where-to-go-84243.md>)

Original publisher: [Read original article](<https://www.infoblox.com/blog/threat-intelligence/when-a-wallet-drainer-asks-dns-where-to-go/>)

Author: Infoblox Threat Intel

Published: 2026-10-09T14:00:31Z

Content type: article

Language: en

Sources: [Infoblox](<https://devfeed.tech/sources/infoblox-blog.md>)

Topics: [Domain Name System (DNS)](<https://devfeed.tech/topics/dns-resolution-process.md>), [DNSSEC](<https://devfeed.tech/topics/dnssec.md>), [DNS security](<https://devfeed.tech/topics/dns-security.md>), [Cloudflare](<https://devfeed.tech/topics/cloudflare.md>)

Tags: [1-1-1-1](<https://devfeed.tech/tags/1-1-1-1.md>), [ai-developed-malware](<https://devfeed.tech/tags/ai-developed-malware.md>), [attack](<https://devfeed.tech/tags/attack.md>), [c2](<https://devfeed.tech/tags/c2.md>), [cloud-hosted-infrastructure](<https://devfeed.tech/tags/cloud-hosted-infrastructure.md>), [cloudflare-pages](<https://devfeed.tech/tags/cloudflare-pages.md>), [crypto-phishing](<https://devfeed.tech/tags/crypto-phishing.md>), [cryptocurrency-theft](<https://devfeed.tech/tags/cryptocurrency-theft.md>), [detecting-dns-command-and-control](<https://devfeed.tech/tags/detecting-dns-command-and-control.md>), [dns](<https://devfeed.tech/tags/dns.md>), [dns-abuse](<https://devfeed.tech/tags/dns-abuse.md>), [dns-c2](<https://devfeed.tech/tags/dns-c2.md>), [dns-over-https](<https://devfeed.tech/tags/dns-over-https.md>), [dns-txt-records](<https://devfeed.tech/tags/dns-txt-records.md>), [doh-abuse](<https://devfeed.tech/tags/doh-abuse.md>), [https](<https://devfeed.tech/tags/https.md>), [infoblox-threat-intel](<https://devfeed.tech/tags/infoblox-threat-intel.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [noir-drainer](<https://devfeed.tech/tags/noir-drainer.md>), [phishing-kit](<https://devfeed.tech/tags/phishing-kit.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [wallet-drainer](<https://devfeed.tech/tags/wallet-drainer.md>), [walletconnect](<https://devfeed.tech/tags/walletconnect.md>)

### AI overview

The Noir cryptocurrency wallet drainer uses DNS TXT records and public DNS-over-HTTPS services to locate its active backend pool, allowing operators to redirect existing lure pages when infrastructure changes. The report describes the drainer's wallet-permission theft flow and unusually detailed source comments, while noting that AI assistance is a possibility rather than a confirmed fact.

### Source excerpt

How the Noir kit uses DNS TXT records and DoH as a dynamic infrastructure control plane Executive summary We found a cryptocurrency wallet-drainer kit, self-branded as Noir, that uses DNS TXT records to locate its hosted pool; currently these run on Cloudflare Pages. The loader races three public DNS-over-HTTPS (DoH) services and uses the first [...] The post When a Wallet Drainer Asks DNS Where to Go appeared first on Infoblox Blog.