How kids are using hacked Discord servers or Twitter accounts and “NFT drainers” for phishing attacks to steal millions of dollars' worth of NFTs and tokens
Tim Copeland / The Block :
Context & Ripple Effects
NFT phishing has been escalating since spring 2022, when a hacker drained millions of dollars of NFTs through a compromised BAYC Instagram account pushing a malicious mint link, and the same week saw BAYC's own Discord servers breached by fake-mint scammers. By mid-2022, VICE was documenting [[a:979416|Discord's outsized role in crypto and Web3 communities alongside rampant spam, phishing, and malware]] — the infrastructure these attacks ride on.
First-order effects
- Holders of NFT projects concentrated on Discord and Twitter face mint-link scams launched from hijacked official accounts, with 'drainer' tooling converting a single click into the loss of wallets' NFTs and tokens.
- Project teams running community operations on those platforms now bear direct financial exposure from account compromise, not just reputational risk.
Second-order effects
- As The Block reports, the operators are increasingly kids using off-the-shelf drainer kits — meaning attack supply no longer depends on skilled hackers, so the volume of compromised-account scams rises faster than defenses can be patched per incident.
- Platforms hosting Web3 communities — Discord above all — face pressure to harden account security and moderation, since their servers have become the default delivery channel for theft at scale.
Third-order effects
- If drainer kits keep lowering the skill floor, account-takeover phishing becomes a commodity crime run through youth networks, echoing earlier patterns like the 2019 Discord channels trading stolen PayPal accounts and card numbers — and the same platform-hosted underground that Wired found in its analysis of predators grooming kids across Discord and Telegram chats.
- Sustained theft pressure could push NFT projects toward verified-signing flows and off-Discord infrastructure, structurally weakening the community-platform model that made Web3 distribution cheap.
The trend: Crypto theft is industrializing from bespoke hacks into commodified drainer kits operated by minors over hijacked Discord and Twitter accounts, turning platform account security into the binding constraint on Web3 communities.