Blockchain security firm Salus has uncovered a crypto theft operation operating behind a platform called “Revenue.” The web application lures potential victims by offering to convert X Money balances into crypto assets without requiring Know Your Customer (KYC) verification. On its website, the platform promises direct payouts in USDC, USDT, SOL, or ETH. However, instead of receiving funds, users discover that the USDG tokens in their wallets have vanished.
To attract crypto users, Revenue’s operators enlisted influencers and Key Opinion Leaders (KOLs). Salus researchers compared this influencer-driven promotional tactic to methods previously used by the platform FomoPeek. While Revenue’s website displays a disclaimer stating that it is not affiliated with X Corp and is not an official part of X Money, its promise of instant cashouts continues to trap users.
Unlimited Approvals in Seconds
The theft relies on manipulating blockchain permit signature features. When users connect their wallets and attempt a conversion, the Revenue platform presents an approval request. In reality, that signature grants the attacker’s smart contract unlimited access to control the victim’s USDG tokens.
Once approval is granted, the hackers immediately execute the transferFrom function within the very same second in a rapid sequence of transactions. This rapid succession of commands instantly transfers the USDG tokens, leaving users virtually no window of time to spot the anomaly or revoke the approval.
Fund Flow Pattern Points to Inferno Drainer Syndicate
As of the report’s release, Salus has not confirmed an exact figure for total losses from the transactions involving Revenue. However, on-chain tracking revealed other findings regarding where the stolen funds are routed. Each time a victim’s wallet is drained, the system automatically splits the loot into two parts: 20% is sent to a specific address, while the remaining 80% goes to another address.
This 20/80 split is identical to the Inferno Drainer-as-a-Service business model. The syndicate rents out its draining infrastructure to other scammers in exchange for a 20% commission cut from every theft. Inferno Drainer has an extensive track record in the crypto ecosystem, having previously been linked to losses reaching $52.74 million across numerous wallet breach incidents.
Offers of no-KYC conversion services consistently find an audience among users seeking to bypass exchange bureaucracy. The Revenue case reinforces that such convenience is often merely a cover to conceal requests for full-access approvals.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
