When a Wallet Drainer Asks DNS Where to Go

This report describes the Noir wallet-drainer kit which uses DNS TXT records and public DoH queries to dynamically locate short‑lived cloud-hosted drainer pools; lure pages remain stable while a 60‑second TXT-based control plane repoints victims to active backend infrastructure that tailors approval/signature requests to each wallet, captures permissions, and executes theft via attacker relays. The analysis includes observed domains, loader behavior, DoH provider use, self-healing and caching logic, and unusually verbose developer comments embedded in the code.