<p class="is-style-lead">Crypto security firm CertiK has warned that a known wallet drainer has moved funds into sanctioned crypto tumbler Tornado Cash.</p>



<p>In a May 27 alert, CertiK stated that two externally owned addresses (EOAs), 0x546 and 0x108, deposited 20 ether (ETH) with a market value of $36,473 into Tornado Cash.</p>



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="583" height="809" src="https://crypto.news/app/uploads/2023/05/image-87.png" alt="Source: Twitter" class="wp-image-14162250"/><figcaption class="wp-element-caption">Source: <a href="https://twitter.com/CertiK" data-type="URL" data-id="https://twitter.com/CertiK" target="_blank" rel="noopener">CertiK</a> on Twitter</figcaption></figure>



<p>Per the alert, the funds came from a <a href="https://cloudsek.com/threatintelligence/private-drainer-for-metamask-crypto-wallets#:~:text=The%20private%20drainer%20transfers%20the,the%20tokens%20and%20approved%20transactions." target="_blank" rel="noreferrer noopener">wallet drainer</a>, a malicious file that automatically moves crypto from the wallets of unsuspecting visitors to phishing sites.</p>



<p>While CertiK claimed the address from which the funds originated was a known wallet drainer, it did not reveal any past exploits associated with it.</p>



<h2 class="wp-block-heading" id="scammers-post-phishing-link-nahmii-discord-channel">Scammers post phishing link Nahmii Discord channel</h2>



<p>It was not the only alert CertiK <a href="https://crypto.news/certik-blames-zksyncs-merlindex-hack-on-private-key-management-issue/" target="_blank" rel="noreferrer noopener">issued</a> over the weekend, as hackers and exploiters kept up their attacks on crypto platforms.</p>



<p>The on-chain security company also alerted users to a fake token airdrop link posted on layer-2 (L2) protocol Nahmii’s Discord channel. CertiK cautioned Nahmii users from clicking on the link, which it claimed led to another known wallet drainer.</p>



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="587" height="380" src="https://crypto.news/app/uploads/2023/05/image-86.png" alt="Source: Twitter" class="wp-image-14162249"/><figcaption class="wp-element-caption">Source: <a href="https://twitter.com/CertiK" data-type="URL" data-id="https://twitter.com/CertiK" target="_blank" rel="noopener">CertiK</a> on Twitter</figcaption></figure>



<p>Nahmii is an L2 protocol on Ethereum that provides transactions for decentralized applications (dApps). It uses a hybrid consensus mechanism that combines proof-of-stake (PoS) and proof-of-transfer (PoT) to achieve finality and security.</p>



<p>Its native NII token is used for staking, governance, and settling fees on the network. CertiK advised Nahmii users to refrain from clicking on any links until the Nahmii team confirmed regaining server control.</p>



<p>CertiK also attracted crypto users’ attention to a fake Refund (RFD) airdrop allegedly promoted on Twitter by @Arnoldty_eth, an account with over 8,000 followers.</p>



<figure class="wp-block-image size-full"><img decoding="async" loading="lazy" width="593" height="665" src="https://crypto.news/app/uploads/2023/05/image-88.png" alt="Source: Twitter" class="wp-image-14162251"/><figcaption class="wp-element-caption">Source: <a href="https://twitter.com/Arnoldty_eth" data-type="URL" data-id="https://twitter.com/Arnoldty_eth" target="_blank" rel="noopener">ArnoldTY</a> on Twitter</figcaption></figure>



<p>The account promoting the alleged scam posted instructions on how to claim the RFD airdrop, which included entering a website that CertiK <a href="https://skynet.certik.com/alerts/security/b10fe235-d7aa-4835-972d-d4e38868a137" target="_blank" rel="noreferrer noopener">claimed</a> connected to a phishing contract, 0x146.</p>



<p>Lately, crypto scammers have used active crypto Twitter accounts to knowingly or unknowingly promote <a href="https://crypto.news/the-sandbox-issues-phishing-alert-for-new-scam/" target="_blank" rel="noreferrer noopener">phishing scams</a>.</p>



<p>On May 26, hackers took over a popular Twitter account, @steveaoki, and used it to push a fake airdrop that caused unsuspecting users to lose over $170,000. Other accounts, such as @eth_ben, <a href="https://crypto.news/compromised-twitter-account-amplifies-crypto-phishing-scam/" target="_blank" rel="noreferrer noopener">exacerbated</a> the scam, unwittingly pushing the fake promo and getting it seen by even more people.</p>



<div class="cn-block-related-link">

    <svg class="cn-block-related-link__icon icon" aria-hidden="true">
        <use xlink:href="#icon-bookmark"></use>
    </svg>

    
        <span class="cn-block-related-link__prefix">
            You might also like:
        </span>

    
    
        <a href="https://crypto.news/certik-freezes-160k-stolen-in-merlin-dex-insider-rug-pull/" class="cn-block-related-link__link">
            CertiK freezes $160k stolen in Merlin DEX insider rug pull        </a>

    
</div>

Wallet drainer moves funds to Tornado Cash

Table of Contents

crypto.news

Other articles published on May 28, 2023

Blockchainreporter Weekly Crypto News Review

DigiToads stands out with unique utilities, dogecoin and shiba inu demand rising

Weekly Round-Up #52 | The Ripple Effect: Understanding How US Debt Shapes Crypto Trends

Ethereum and NFT Market: Blur Blend’s Performance Sparks New Hope

Prominent Crypto Analyst Forecasts a Noteworthy Shift in Bitcoin’s Trajectory

GTA 6 Having Play-to-Earn Feature Is Rumor, Says Game KOL

Join our free newsletter for daily crypto updates!