Venom

Security

Discord

<p><strong>When crypto investor Ronald Mol clicked on an airdrop link shared by a trusted moderator in a Discord channel, little did he know the account had been taken over by a scammer equipped with the notorious Pink Drainer kit.&nbsp;</strong></p>
<p>I felt like a real dumbass. How could I have been so stupid to fall for this? Mol tells Magazine.</p>
<p>In draining kits, a developer or a team provides cybercriminals with a script alongside a tutorial on how to use it in exchange for a fee.</p>
<p>Sometimes, they have someone available that can build the customer a website if they have no skills in that area themselves, and in return, they get 20% to 30%, Plum, a pseudonymous blockchain security researcher, tells Magazine.</p>
<p>Mol considers himself fortunate for not having many tokens in that particular wallet.&nbsp;</p>
<p>However, not all victims share the same luck. Pseudonymous investor Trout tells Magazine that another malicious airdrop link led to the loss of $210,000 worth of crypto.</p>
<p>I wanted to die, Trout says.</p>
<section class="adv-banner adbutler-ad adbutler-ad__desktop">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=728x90;setID=601214;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
 </div>
</section>
<section class="adv-banner adbutler-ad adbutler-ad__mobile">
 <div class="container">
  <a href="https://servedbyadbutler.com/go2/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100" target="_blank"><img src="https://servedbyadbutler.com/adserve/;ID=169476;size=300x250;setID=601213;referrer=https%3A%2F%2Fcointelegraph.com%2Fmagazine%2Fwp-json%2Fwp%2Fv2%2Fposts%3F_embed%26per_page%3D100;type=img"></a>
 </div>
</section>
<p>The Pink Drainer kit assisted illicit actors in stealing<a href="https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam" target="_blank" rel="nofollow"> at least $18 million</a> [update, Pink contacted Magazine to ask for a correction and says it’s actually $53 million, confirmed by Scam Sniffer] in crypto assets from over 9,000 victims last year, including a $4.4 million theft from one investor alone.</p>
<h2 class="wp-block-heading" id="h-crypto-scams-social-engineering-hacking-and-phishing"><strong>Crypto scams: Social engineering, hacking and phishing</strong></h2>
<p>The developer of this drainer, who operates under the pseudonym Pink, doesnt use the term victims, preferring to call those affected by the scam participants.</p>
<p>Most people getting drained are Chinese nationals who arent really supposed to be doing this whole DeFi thing in the first place, [and] some westerners get caught in the crossfire, Pink tells Magazine.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img decoding="async" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-profile.png" alt="" class="wp-image-29643" width="534" height="530" srcset="https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-profile.png 991w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-profile-300x298.png 300w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-profile-100x100.png 100w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-profile-770x764.png 770w" sizes="(max-width: 534px) 100vw, 534px">
 <figcaption class="wp-element-caption">
  <em>Pink, whose Telegram profile features an animated cat, frequently shared cat memes when talking with Magazine. (Pink on Telegram)</em>
 </figcaption>
</figure>
<p>Pinks clients often use social engineering tactics, including hacking the social media accounts of influential figures.</p>
<p>In late February, MicroStrategys compromised X account shared a now-deleted tweet promoting a fake Ethereum token. It <a href="https://cointelegraph.com/news/microstrategy-x-account-hacked-phishing-scam" target="_blank" rel="nofollow">led to a phishing scam</a> that drained over $420,000 in cryptocurrencies.</p>
<p>Blockchain records show that a portion of the loot from the MicroStrategy case was rerouted to a wallet associated with Pink Drainer.&nbsp;</p>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/6-questions-kei-oda-cryptocurrency/" class="article-suggest__subtitle display4"> <span>6 Questions for...</span> <p>6 Questions for Kei Oda: From Goldman Sachs to cryptocurrency</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/building-blocks-millennials-use-crypto-tokens-property-ladder/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Building blocks: Gen Y can use tokens to get on the property ladder</p> </a> 
  </div>
 </div>
</div>
<p>With that, the worlds largest corporate Bitcoin holder joined a growing list of public figures, including Ethereum co-founder Vitalik Buterin and OpenAI chief technology officer Mira Murati, whose social media accounts have been exploited in Pink Drainer-linked phishing schemes.&nbsp;</p>
<figure class="wp-block-image aligncenter size-full">
 <img decoding="async" width="645" height="376" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/PinkDrainer-Telegram-channel.png" alt="Pink Drainer promotes a successful crypto heist by sharing an emoji of a whale and the amount stolen." class="wp-image-29646" srcset="https://cointelegraph.com/magazine/wp-content/uploads/2024/03/PinkDrainer-Telegram-channel.png 645w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/PinkDrainer-Telegram-channel-300x175.png 300w" sizes="(max-width: 645px) 100vw, 645px">
 <figcaption class="wp-element-caption">
  <em>Pink Drainer promotes a successful heist. (Pink Drainer on Telegram)</em>
 </figcaption>
</figure>
<p>Pink claims to feel no guilt or remorse when benefiting from the losses of participants, arguing that it is natural for someone to lose money for another to gain.</p>
<p>I dont phish anyone, I just code, Pink adds.</p>
<h2 class="wp-block-heading" id="strong-from-fighting-crypto-scams-to-creating-crypto-scams-strong"><strong>From fighting crypto scams to creating crypto scams</strong> </h2>
<p>According to Plum, Pink has an intriguing history.</p>
<p>Before he became Pink, he was a security researcher or at least he pretended to be in order to get a better look at some of the security projects inner workings, Plum says.</p>
<p>The developer was known in the security community as Blockdev and allegedly operated the X account @ChainThreats, according to Plum.</p>
<p>The account has since been deactivated, but a <a href="https://web.archive.org/web/20221116130622/https://twitter.com/chainthreats" target="_blank" rel="nofollow">snapshot</a> of Blockdevs activity can still be viewed via the Internet Archives Wayback Machine.</p>
<figure class="wp-block-image aligncenter size-large is-resized">
 <img decoding="async" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.--1024x360.png" alt="" class="wp-image-29648" width="1116" height="392" srcset="https://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.--1024x360.png 1024w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.--300x105.png 300w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.--770x271.png 770w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.--1536x540.png 1536w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/ChainThreats-X-account-snapshot.-.png 1880w" sizes="(max-width: 1116px) 100vw, 1116px">
 <figcaption class="wp-element-caption">
  <em>A snapshot of ChainThreats X account taken on Nov. 16, 2022. (Internet Archive)</em>
 </figcaption>
</figure>
<p>Blockdev was known to a few members of the security community as someone who worked to sabotage the schemes of drainers.</p>
<p>In particular, Blockdev regularly attempted DDoS attacks or hacks against Monkey, a pioneer among drainers who <a href="https://cointelegraph.com/news/notorious-monkey-drainer-crypto-scammer-says-they-re-shutting-down" target="_blank" rel="nofollow">announced their retirement</a> in March 2023 while directing potential clients to an alternative service known as Venom Drainer.</p>
<figure class="wp-block-image aligncenter size-full is-resized">
 <img decoding="async" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pocket-Universe-tweet-blockdev-Monkey-Drainer.png" alt="" class="wp-image-29647" width="540" height="645">
 <figcaption class="wp-element-caption">
  <em>A community X post documents Blockdevs past battles against Monkey Drainer. (Pocket Universe on X)</em>
 </figcaption>
</figure>
<p>Fantasy, the founder of blockchain security firm Blockmage Labs, had one of the last <a href="https://www.theblock.co/post/235022/phishing-frenzy-school-kids-are-stealing-millions-of-dollars-of-nfts-to-buy-roblox-skins" target="_blank" rel="nofollow">reported</a> message exchanges with Blockdev before they became Pink.</p>
<p>Fantasy says the two once hypothesized a potential attack on Venom Drainers back end system using specifically crafted <a href="https://etherscan.io/tx/0x1727d57bdce3685893d337530cc540148715d56cde315de50bc8b188337d7b48" target="_blank" rel="nofollow">orders</a> at NFT marketplace Blur.&nbsp;</p>
<p>This effort ultimately led to the revelation of Blockdevs wallet address.</p>
<div class="article-suggest"> 
 <div class="article-suggest__title display3">
  Read also
 </div> 
 <div class="article-suggest__items"> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/man-in-shanghai-special-the-industry-fall-out-from-chinas-crypto-crackdown-and-what-happens-next/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Shanghai Special: Crypto crackdown fallout and what happens next</p> </a> 
  </div> 
  <div class="article-suggest__item"> <a href="https://cointelegraph.com/magazine/play2earn-blockchain-gaming-economies/" class="article-suggest__subtitle display4"> <span>Features</span> <p>Play2Earn: How Blockchain Can Power a Paradigm Shift in Building Game Economies</p> </a> 
  </div>
 </div>
</div>
<p>Later, he would then use the same wallet as a fee receiver for his draining service, Fantasy claims.</p>
<p>The Blockmage founder recollects that Blockdev provided valuable insights and research on various security topics, albeit in a condescending manner.</p>
<figure class="wp-block-image aligncenter size-large is-resized">
 <img decoding="async" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/Fantasy-and-Pink-Drainer-on-backend-1024x542.png" alt="" class="wp-image-29649" width="998" height="528" srcset="https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Fantasy-and-Pink-Drainer-on-backend-1024x542.png 1024w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Fantasy-and-Pink-Drainer-on-backend-300x159.png 300w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Fantasy-and-Pink-Drainer-on-backend-770x408.png 770w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Fantasy-and-Pink-Drainer-on-backend.png 1267w" sizes="(max-width: 998px) 100vw, 998px">
 <figcaption class="wp-element-caption">
  <em>The transaction that revealed Blockdevs wallet address to Fantasy. (Etherscan)</em>
 </figcaption>
</figure>
<p>My last conversation with him before he disabled his Blockdev Discord account was short, simply consisting of an inside joke only the Pink Drainer alias would understand, an acknowledgment from him, and subsequently going offline, Fantasy adds.</p>
<h2 class="wp-block-heading" id="pink-drainer-money-laundering-crypto-scams-and-mental-health">Pink drainer, money laundering, crypto scams and mental health</h2>
<p>Pink tells Magazine that he prefers to keep his ill-gotten gains in Dai, an algorithmic stablecoin pegged to the value of the U.S. dollar.&nbsp;</p>
<p>An Ethereum wallet with a Pink Drainer label <a href="https://etherscan.io/address/0xA5e4B451D0A3C3D05Fc3A8076fda45952b8f4F83#tokentxns" target="_blank" rel="nofollow">holds</a> over $4.49 million in Dai as of March 8.</p>
<figure class="wp-block-image aligncenter size-large is-resized">
 <img decoding="async" src="http://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance-1024x270.png" alt="" class="wp-image-29650" width="1119" height="295" srcset="https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance-1024x270.png 1024w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance-300x79.png 300w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance-770x203.png 770w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance-1536x405.png 1536w, https://cointelegraph.com/magazine/wp-content/uploads/2024/03/Pink-Drainer-wallet-balance.png 1681w" sizes="(max-width: 1119px) 100vw, 1119px">
 <figcaption class="wp-element-caption">
  <em>Pinks Ethereum wallet balance. (Etherscan)</em>
 </figcaption>
</figure>
<p>The developer asserts that there are no immediate intentions to convert earnings to fiat, preferring instead to watch the pile grow.</p>
<p>While the advancement of global crypto regulations and KYC requirements at centralized exchanges pose significant hurdles for cybercriminals looking to liquidate their assets, Plum says there are still plenty of alternative channels.</p>
<p>These include laundering or even purchasing KYC credentials or data from someone else.</p>
<p>Low-income [and] third-world areas will quite happily sell their ID info for that purpose, Plum adds.</p>
<p>In a now-deleted Telegram message to Magazine, Pink admits to his deteriorating physical and mental health.&nbsp;</p>
<p>The draining scheme has become all-consuming for Pink, leading to lost sleep and a singular focus on nothing else.</p>
<p>Pink has now stopped responding to Magazine.</p>
<p>I am a busy guy, Pinks last message says.&nbsp;</p>
<div class="subscribe subscribe--inner">
 <div class="container">
  <div class="subscribe__inner">
   <div class="subscribe__content"> 
    <div class="subscribe__title display2">
     Subscribe
    </div> 
    <div class="subscribe__desc text-l">
     The most engaging reads in blockchain. Delivered once a week.
    </div> 
    <div class="wpcf7 no-js" id="wpcf7-f13672-o1" lang="en-US" dir="ltr">
     <div class="screen-reader-response">
      <p role="status" aria-live="polite" aria-atomic="true"></p> 
      <ul></ul>
     </div>
     <form action="/magazine/wp-json/wp/v2/posts?_embed&amp;per_page=100#wpcf7-f13672-o1" method="post" class="wpcf7-form init subscribe__form demo" aria-label="Contact form" novalidate data-status="init">
      <div style="display: none;">
       <input type="hidden" name="_wpcf7" value="13672">
       <input type="hidden" name="_wpcf7_version" value="5.7.7">
       <input type="hidden" name="_wpcf7_locale" value="en_US">
       <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f13672-o1">
       <input type="hidden" name="_wpcf7_container_post" value="0">
       <input type="hidden" name="_wpcf7_posted_data_hash" value="">
      </div>
      <fieldset class="form-group">
       <p><input size="40" class="wpcf7-form-control wpcf7-text wpcf7-email wpcf7-validates-as-required wpcf7-validates-as-email" id="footer-subscribe" aria-required="true" aria-invalid="false" value="" type="email" name="your-email"><label for="footer-subscribe">Email address</label></p>
      </fieldset>
      <p><button class="subscribe__btn btn btn-white">SUBSCRIBE</button></p>
      <div class="wpcf7-response-output" aria-hidden="true"></div>
     </form>
    </div>
   </div>
   <div class="subscribe__img"> 
    <img src="https://cointelegraph.com/magazine/wp-content/uploads/2022/10/reading-copy.png" alt="Subscribe to Magazine by Cointelegraph Newsletter.">
   </div>
  </div>
 </div>
</div>

Inside Pink Drainer: Security analyst defends his crypto scam franchise

Table of Contents

Cointelegraph

Other articles published on Mar 13, 2024

Will Terra Luna Classic Rally in 2024 Like WIF and NUGX?

Will MATIC Could Be the Dark Horse of the Next Crypto Boom

Coinbase unveils $1B convertible notes offering for institutional investors

Price analysis 3/13: BTC, ETH, BNB, SOL, XRP, ADA, DOGE, SHIB, AVAX, TON

BlackRock’s iShares Leads Charge: Bitcoin ETFs Hit $1 Billion Inflows!

TRON Network boosts accessibility with Token Terminal integration

Join our free newsletter for daily crypto updates!