🚨 XPR NETWORK WALLET DRAINER — full infrastructure teardown of "xprdrop . com" Following up on my mitigation post. Here's the machine behind the "XPRDROP airdrop" scam draining XPR Network wallets — the accounts, the backend API, the cloaking, and the money flow. Everything below is on-chain or observable. The accounts (4 on-chain): • xprdrops — deploys the fake "XPRDROP" lure token • symbiote — drainer/controller (wave 1) • xprgrant — drainer/controller (wave 2) • rasmr5 — cash-out staging All created 26–30 Jul, days before the spray. It was rehearsed. Before any real victim, the attacker ran the full grant→drain flow TWICE on their own test accounts (justingates→symbiote, rasmr5→xprgrant), recycling the same ~8,935 XPR. Then deployed the lure and went live. Premeditated. Delivery = the token memo itself. Wallets render it as the tx description, so the phishing link lands straight in your wallet UI via a token you never requested. ~2,900+ wallets sprayed, still running. The lure copy is even A/B tested ("up to $10k" is winning). The frontend cloaks itself. It's a Vite SPA titled "XPR Network — Community Rewards." Before it even loads, it calls its backend to decide if YOU should see it. Flagged IPs / researchers get bounced to google .com and permanently marked (xpr_v_blk=1). That's why analysts see a blank page. The backend — api . xprdrop . com/api/analytics — is an Express server with 5 endpoints: • GET /check — cloaking gate • POST /visit — landing telemetry • POST /wallet — your full portfolio • POST /claim — outcome • GET /w — backup beacon /wallet is the nasty one: on connect it exfils your account, XPR (liquid + staked + unstaking), up to 30 token holdings, and eligibility. Connecting ALONE leaks your entire portfolio — before you sign anything. The drain payload is built per-victim. It ranks your holdings against a 39-token priority list (XBTC, XETH, stables first), links up to 20 token contracts to the malicious "claim" permission, and deliberately SKIPS locked.token (can't be moved). Whoever built this knows Antelope. Real-time relay. The API replies {"ok":true,"sent":true} — it forwards each profile to the operator instantly (bot/webhook). That's why the drain lands ~15 seconds after you sign: they're pinged the moment you connect, and sweep immediately. It persists — and re-drains. Because it's a permission, not a transfer, it has an "extend" mode: revisit and it skips the grant, just links your NEW tokens. One wallet got drained a SECOND time for ~1.5M XPR after topping up. Delete the permission or it never stops. Infra: xprdrop . com + api → 80.78.18.13, hosted on Njalla (privacy shield), AS39287 Materialism s.r.l., Malmö SE. Registrar Tucows, registrant Nevis (redacted). Domain registered 30 Jul 2026 — hours before the lure token went live. Money flow: stolen tokens → swapped to XPR on Alcor / proton.swaps → consolidated in xprgrant → forwarded to rasmr5 → deposited to HitBTC (hitbtcxprins, memo 7773400473558716). Only ~200K XPR has left the chain. **~2.35M XPR is still sitting in the attacker accounts.** Possible prior: shares an off-ramp + near-identical ~1.5M XPR pattern with an April drain (acct "yougothacked" → same HitBTC deposit account). Could be the same actor — but no key overlap, so unconfirmed. Exchange KYC could settle it. — IOCs — Domains: xprdrop .com / api .xprdrop.com → 80.78.18.13 (Njalla, AS39287) Accounts: xprgrant · symbiote · xprdrops · rasmr5 · justingates (test) Keys: xprgrant EOS8EYZXNVFLeFNKLqegtBVKyqFq78Mbo7rwrsQfyc4VB6XhBhDtS · symbiote EOS73WoPhPHppr7vT5NFXJgUa75h2efiT8dvzb6WDWRWwcpGPxnsS Grant: permission "claim" → xprgrant@active (or symbiote@active) Cash-out: rasmr5 → hitbtcxprins, memo 7773400473558716 Never sign airdrop "claims." 🙏 RT to spread.