Ethereum Foundation and SEAL Fund Dedicated Threat Hunting to Curb Crypto Drain Attacks

Highlights:

• Ethereum Foundation and SEAL have launched a funded effort to track and stop wallet drainer attacks.
• The sponsorship adds a dedicated security engineer to focus only on drainer activity and live attack tracking.
• The initiative expands coordinated threat monitoring to reduce user losses from social engineering attacks.

Ethereum Foundation has agreed to sponsor the crypto security nonprofit Security Alliance, known as SEAL. The group said the funding supports expanded tracking of wallet drainer activity. Discussions between both parties on the funding dedicated to security engineering work began late last year.

SEAL said the sponsorship operates under its Trillion Dollar Security initiative. The initiative focuses on large-scale attacks affecting Ethereum users. SEAL approached the foundation after tracking sustained drainer development. The group cited the increased use of social engineering methods to drain wallets. It also pointed to the repeated losses tied to wallet approvals.

The foundation is now funding a dedicated security engineer. SEAL said the engineer will work inside its intelligence team. The role focuses on tracking drainer tooling and deployment patterns. It also involves monitoring attacker infrastructure linked to active campaigns. SEAL said the engineer will assist during live incident coordination.

SEAL shares technical findings with affected projects during attacks. The group also works with service providers when incidents unfold. In several cases, SEAL has helped identify malicious contracts. It has also supported efforts to trace stolen funds.

Ethereum Foundation and SEAL Step Up Protection for Everyday Users

The Ethereum Foundation and SEAL said the effort centers on attacks that target users directly. Wallet drainers rely on phishing and impersonation tactics. Attackers often build websites that copy trusted crypto platforms. They also distribute fraudulent emails and links. These messages prompt users to approve transactions. Once approved, attackers gain access to wallet assets. These incidents do not involve protocol exploits. Instead, they rely on user interaction. SEAL said this makes detection more difficult.

The recent loss data illustrate the scale of the issue. Crypto intelligence platform ScamSniffer estimates that scammers stole nearly $1 billion over several years. The firm reported a sharp decline in 2025. The losses fell to about $84 million during the year. Investigators have linked the reduction to early identification of malicious activity by security firms.

SEAL said faster reporting helped limit exposure, and shared alerts allowed projects to respond sooner. Wallet providers also acted more quickly after detection. These steps reduced the time attackers remained active.

The Ethereum Foundation responded publicly to SEAL’s announcement. “The Security Alliance has done important work to combat attacks,” the foundation wrote on X. It added that the ecosystem has benefited from these efforts. The post followed confirmation of the sponsorship by SEAL.

Ethereum Foundation Tightens Security Planning Amid Budget Discipline

SEAL and the foundation have also introduced new monitoring tools. The Trillion Dollar Security dashboard tracks security activity across Ethereum. It monitors six areas across the network. These include user experience and smart contracts. Infrastructure and incident response are also listed. Each area includes defined risk controls. The dashboard also lists priority work items. SEAL said the tool allows teams to track unresolved issues. The dashboard remains publicly accessible.

The rollout comes in the wake of broader planning at the foundation. Vitalik Buterin recently outlined a five-year strategy that follows a period of mild austerity. The approach focuses on long-term sustainability while the core development work continues. The planning followed renewed attention to governance. The foundation also confirmed steps tied to DAO restructuring.

In a related development, SEAL recently warned about new drainer activity tied to a software flaw. Attackers have been exploiting a vulnerability in React tracked as CVE-2025-55182. The issue allows unauthorized code execution and script injection. SEAL advised crypto websites to review files and remove suspicious code.