Railgun

Pink

Pink Drainer, the drainer-as-a-service hacker group, announced it’s shutting down and deleting all data. Over its lifetime, Pink Drainer targeted communities and specific whale wallets. Estimates put the stolen funds between $75M and $85M, depending on the exact pricing approach.&nbsp; 
The Pink Drainer is a group dedicated to scamming wallet owners, usually through three main points of attack. One is through hacking or spamming high-profile social media accounts, including those of Vitalik Buterin, Crypto Bitboy, and major projects. The other is through Discord and other chats. Some used the drainer-as-a-service on fake sites, urging the user to connect a wallet.&nbsp; 
<h2 class="wp-block-heading" id="more-than-21k-users-lost-valuable-nft-and-fungible-tokens">More than 21K users lost valuable NFT and fungible tokens</h2> 
For over a year, Pink Drainer performed heists ranging from prominent to large-scale. The wallet drainer works on Ethereum, Avalanche, BSC, Polygon, Optimism, Gnosis, and Callisto Network, among others. More than 21K users lost valuable NFT and fungible tokens.&nbsp; 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-us.googleusercontent.com/CSjLUhJNmFbid7KHm_Bbk_81Y8Ai22uF3r4A8ylTCNtyJ6tAslP7m6mYCE22KM8NJs_aX0nGijdQHTd10ytCS_740sYjl1on6SlukcSMdW6Pp3f3zQQUdRLECdOrpPAUif4-3rievRLGVA7EiRUzBBY" alt="Total amount stolen by Pink Drainer and total victim wallets affected, based on Dune Analytics data tools.">
</figure> 
Source: Dune Analytics 
The earnings of Pink Drainer come not only from the heists, but from selling the drainer-as-a-service, with 5 ETH for lifetime access. This means that the hacks of Pink Drainer are not organized but are haphazard and depend on random outreach. 
Also read: <a href="https://www.cryptopolitan.com/compound-finance-breach-of-its-x-account/">Compound Finance suffers a breach of its X account</a> 
The users of Pink Drainer’s service are also not shy about their <a href="https://etherscan.io/txs?a=0xA1B82002545Ee19a373Af3D9962e902411E4043A&amp;p=1" rel="nofollow noopener" target="_blank">on-chain behavior</a>. Some of the wallets even send funds to Binance for swapping. Most users are semi-anonymous, and still use their social media personas.&nbsp; 
<h2 class="wp-block-heading" id="how-will-pink-drainer-affect-decentralized-finance">How Will Pink Drainer Affect Decentralized Finance?</h2> 
One effect of Pink Drainer is that its users may park some of the funds into DeFi protocols. Drainer users also often rely on Uniswap to convert the stolen funds.&nbsp; 
Pink Drainer is still the <a href="https://etherscan.io/token/0x83F20F44975D03b1b09e64809B757c47f942BEeA#balances" rel="nofollow noopener" target="_blank">top 21 owner</a> of SavingsDAI (sDAI), a token belonging to Spark Protocol. So far, the drainer wallet holds onto the funds, even days after announcing the end of exploits. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#PeckShieldAlert</a> <a href="https://twitter.com/hashtag/PinkDrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#PinkDrainer</a> announced they will be shutting down. <a href="https://twitter.com/hashtag/PinkDrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#PinkDrainer</a> addresses have staked a total of~18.1m <a href="https://twitter.com/search?q=%24DAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$DAI</a> into <a href="https://twitter.com/hashtag/Spark?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Spark</a>, constituting ~1.348% of the total <a href="https://twitter.com/search?q=%24sDAI&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$sDAI</a> tokens <a href="https://t.co/mLu5HERhZo" rel="nofollow" target="_blank">pic.twitter.com/mLu5HERhZo</a>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1791389262182760917?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">May 17, 2024</a>
</blockquote> 
Spark Protocol is a crypto lending aggregator, currently <a href="https://defillama.com/protocol/spark#information" rel="nofollow noopener" target="_blank">holding $2.36B</a> in total value locked (TVL). The funds held by Pink Drainer will hardly affect the protocol, which is also supported by other large wallets and exchanges.&nbsp; 
<h2 class="wp-block-heading" id="pink-drainer-turns-ethical-hacker">Pink Drainer Turns Ethical Hacker</h2> 
Users affected by Pink Drainer may be able to receive some respite. The official X handle made a special offer to restitute some funds, with a time limit in the past eight months. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 <a href="https://twitter.com/hashtag/Pinkdrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Pinkdrainer</a> <a href="https://twitter.com/hashtag/Tapswap?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#Tapswap</a> <a href="https://twitter.com/search?q=%24PONKE&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$PONKE</a> <a href="https://twitter.com/search?q=%24WIF&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">$WIF</a> <a href="https://twitter.com/hashtag/fakephishing?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#fakephishing</a> <a href="https://twitter.com/hashtag/drainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#drainer</a> <a href="https://twitter.com/hashtag/walletdrainer?src=hash&amp;ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">#walletdrainer</a> <a href="https://t.co/wl7YgKVVM9" rel="nofollow" target="_blank">pic.twitter.com/wl7YgKVVM9</a>— Pink Drainer | pink-drainer.eth (@pinkdrainer_) <a href="https://twitter.com/pinkdrainer_/status/1791879456702726283?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">May 18, 2024</a>
</blockquote> 
Some funds, however, may already be beyond reach. About two weeks ago, Pink Drainer started moving its finds. Some of the stolen ETH is just parked in idle addresses. Other transactions have reached 1 Inch Network Aggregator, and Railgun WETH Helper, a service for private and anonymous DeFi.&nbsp; 
Railgun is still a relatively small service, reporting $68M in total value locked. What is curious is that its <a href="https://defillama.com/protocol/railgun#information" rel="nofollow noopener" target="_blank">TVL has grown significantly</a> since Pink Drainer started to unload some of the funds.&nbsp; 
When it comes to NFT, returning them is even more difficult. Bored Ape <a href="https://opensea.io/0x7310FFB474Ed92b88fb3BEBa08b643Ec4ec20d1c" rel="nofollow noopener" target="_blank">7531</a>, for instance, is already part of someone else’s collection after one of the last big attacks of Pink Drainer. 
<h2 class="wp-block-heading" id="drainer-threat-is-not-gone">Drainer Threat is Not Gone</h2> 
The threat of having a wallet drained is not gone. Pink Drainer itself warned of copycats or new links to connect wallets.&nbsp; 
Additional drainers are still offered to anyone and deployed via social media scams. The common thread is that all the scams offer valuable giveaways while requiring users to connect their wallets.&nbsp; 
Also read: <a href="https://www.cryptopolitan.com/cybercriminal-group-pink-drainer-strikes-again-4-4-million-theft-in-chainlink/">Cybercriminal group “Pink Drainer” strikes again: $4.4 million theft in Chainlink</a> 
Most big projects’ social media have also warned that they will not contact users directly. However, data reveals that Inferno Drainer is still active and even more dangerous than Pink Drainer, with more than <a href="https://dune.com/scamsniffer/inferno-drainer" rel="nofollow noopener" target="_blank">$166M in stolen funds</a>. 
Inferno Drainer also claimed it would shut down in December 2023, after setting out a story about reaching its goal. Pink Drainer seems to mimic that approach, and it is uncertain if the threat is gone for good, or will return in another iteration.&nbsp; 
Inferno Drainer also worked by impersonating big crypto brands and spreading a long list of domains promising airdrops or NFT. 
Cryptopolitan reporting by Hristina Beeva

Pink Drainer Shuts Down: How Will Fund Withdrawal Affect DeFi?

Table of Contents

Cryptopolitan_News

Other articles published on May 20, 2024

Missed Out On Solana Meme Coins BONK and WIF? This New Altcoin Is Set To Outperform Both in 2024

Justin Drake’s New Role with EigenFoundation Sparks Criticism Over Potential Conflicts

Why Ethereum Investors Are Excited About This Token

Investors Anticipate Fed Minutes for Insights on Future Monetary Policy

Ethereum clears THIS key hurdle: What’s next for ETH’s price?

Spot Bitcoin ETF Saw Two-Month High Of $948M Net Inflows Last Week

Join our free newsletter for daily crypto updates!