BNBScanPro wallet drainer
BNBScanPro is a fake BNB Chain asset verification page that sends a wallet the gas it needs, then asks it to transfer its whole USDT balance to the operator. We have matched it on 7 sites since 4 November.
BNBScanPro in numbers
Since 4 November, the first BNBScanPro match in our records, counted on 4 November 2026. How we count.
| Sites with BNBScanPro code | 7 |
|---|---|
| Sites with a match in the last 30 days | 7 |
| Latest match | 4 November |
A verification button that checks your balance first
BNBScanPro is a page titled as a BNB Chain asset verification portal, aimed at Trust Wallet users. It runs on the operator's own domains, some of them lookalikes such as binancecheck[.]com, and on shared-hosting staging subdomains. Its own code names the template bnbscan_pro.html.
When the visitor presses the verify button, the page switches their wallet to BNB Smart Chain and reads their address. It then asks a public BNB Chain node for their BEP-20 USDT balance with a raw balanceOf call. The wallet shows no prompt for this, so the page knows what it can take before the visitor has approved anything.
The page pays your gas
A token transfer needs BNB for gas, and a wallet holding only USDT cannot send one. BNBScanPro solves that for the visitor. When the USDT balance is above the build's minimum and the wallet holds less than 0.00015 BNB, the page sends it 0.00006 BNB from a sponsor wallet.
The sponsor wallet's private key sits in the page. In the readable build it is a plain constant; the obfuscated builds assemble it from their string table, some through atob. Anyone who reads the page can spend whatever BNB that wallet holds.
One transfer for the whole balance
With gas in place, the page asks the wallet to send a USDT transfer (0xa9059cbb) to a fixed operator address for the full balance it read earlier. The minimum is 2 USDT in the readable build and 20 or 50 in the obfuscated ones. Below it, the page shows "USDT Verified! Your tokens are genuine and safe to use." and asks for nothing.
Above it, after the transfer request, the page shows "Assets On Hold" with the drained amount as a hold balance and a "Release Funds" button. That button opens a second screen quoting 65% of the amount.
The readable build labels its own sections. The transfer function sits under "Drain Engine (the actual weapon)".
What we see
| Month | New sites |
|---|---|
| September | 0 |
| October | 0 |
| November so far | 7 |
Checking a verification page
Before approving anything on a page that offers to verify your assets, watch what reaches your wallet:
- a network switch to BNB Smart Chain the moment you press verify
- a small BNB deposit you did not ask for, from an address you do not know
- a transaction to the USDT contract (
0x55d398326f99059ff775485246999027b3197955) whose data starts0xa9059cbb: that is a transfer of your tokens, whatever the page calls it
In the page source, sponsorWallet, checkAndRefuel, fetchMaxBalance and open65Warning mark the kit, as do an ethers 5.7.2 import and a 64-character hex string passed to ethers.Wallet.