Back to ScamIntelLogs

NiceCrypto Drainer

TRON Wallet Drainer | Affiliate Program | Active Threat

ACTIVE TRON Network 80% Affiliate Share
80%
Affiliate Share
4
TG Channels
32
Evidence Photos
$8,454+
Recorded Payments

Threat Summary

NiceCrypto is a cryptocurrency wallet drainer service targeting the TRON network. Victims connect wallets via phishing sites, sign malicious approvals, and funds are automatically drained. Launched December 2025, actively operated via Telegram bot with a full affiliate panel. Planning expansion to SOL, EVM, and TON.

Telegram Infrastructure

Setup Bot@NCsetup_bot
Support@NiceCrypto_Support
Info RUSID: 3522562902
Info ENGID: 3605815564
PaymentsID: 3462761505

Web Infrastructure

Documentationwiki.nicecrypto.forum
Forumwwh2club.to (thread 290536)
First Seen2025-12-22
Last Activity2026-01-28
PlannedSOL, EVM, TON

Phishing Landing Page Designs (13)

Landing page templates used by NiceCrypto affiliates to lure victims into connecting wallets. Impersonates major crypto brands including Bybit, TRON, Trust Wallet, and fake exchange/swap interfaces.

Phishing Design 1
Fake Bybit AML Verification
Phishing Design 2
Design 2
Phishing Design 3
Design 3
Phishing Design 4
Fake TRON TRX Airdrop
Phishing Design 5
Design 5
Phishing Design 6
Design 6
Phishing Design 7
Design 7
Phishing Design 8
Design 8
Phishing Design 9
Fake Trust Wallet Card
Phishing Design 10
Design 10
Phishing Design 11
Design 11
Phishing Design 12
Fake USDT/TRX Exchanger
Phishing Design 13
Design 13

Evidence Archive

📖
GitBook Documentation
Affiliate intro, bot settings, manuals
 📢
NC Info ENG Channel
English info channel messages export
 📢
NC Info RUS Channel
Russian info channel messages export
 💰
NC Payments Channel
Payment proofs and affiliate payouts
 🎨
NC Designs Channel
13 landing page designs for phishing
 🛡️
IOCs (JSON)
Structured indicators of compromise

Collected by PhishDestroy | GitHub