Monkey

Security

Pink

CoW Protocol

Major cryptocurrency drainers like Inferno and Pink made headlines this year by announcing they were retiring — but victims continue to lose staggering sums. A crypto drainer typically tricks a user into connecting a wallet and approving a transaction that drains the user’s funds.&nbsp;
In October, more than $20 million was lost to phishing schemes, <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1853736522052464833" rel="null" target="null" text="null" title="null">according to Scam Sniffer</a>. While the month’s volume was down 56% from September, the number of victims — 12,058 — jumped 20% month-over-month.
Alex Katz, CEO and co-founder of internet browser security plugin Kerberus told Cointelegraph that draining volume can vary month by month along with market conditions, but the increasing number of victims was alarming.
Meanwhile, law enforcement and cybersecurity firms are getting better at catching cyber crooks. “We think [drainers are shutting down] because they have earned too much. If they continue, it’s only a matter of time before law enforcement finds them or their accomplices,” Cos, founder of MistTrack, told Cointelegraph.
As an example, Tether, the world’s largest stablecoin issuer, recently froze at least three wallets connected to drainer operations.
While Tether did not respond to request for comment, a private investigator who Cointelegraph has confirmed is working with authorities on crypto draining cases said that the three wallets were frozen at the request of a law enforcement agency.&nbsp;
The investigator has been working with authorities to track down a suspicious entity known as Konpyl. A recent investigation by <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/rabby-scammer-konpyl-crypto-ceo-mountain-victims/" rel="null" target="null" text="null" title="null">Cointelegraph Magazine linked Konpyl</a> and associated wallets to a fake Rabby wallet scam that drained about $1.6 million from victims.&nbsp;
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/apple-yet-to-remove-fake-rabby-wallet-app-despite-users-being-drained" rel="null" target="null" text="null" title="null">Fake Rabby wallet wreaks havoc after listing on Apple App Store</a>
Offchain evidence reviewed by the magazine during the investigation found links between the Konpyl online persona and a Dubai-based crypto CEO who denied any wrongdoing and claimed to be a victim of blackmail.
The latest trio of accounts frozen by Tether not only share links to drainer wallets but to Konpyl as well.&nbsp;
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/01934393-8976-7f57-9213-b347895c3f51" title="">
 <figcaption style="text-align: center;">
 Blacklisted USDT addresses are connected to drainers and Konpyl. (<a data-ct-non-breakable="null" href="https://x.com/usdtblacklist/status/1846559373289545807" rel="null" target="null" text="null" title="null">USDT Blacklist</a>)
 </figcaption>
</figure>
At the very least, “[Konpyl] is a big drainer customer,” the investigator told Cointelegraph. “[Konpyl] mostly uses Inferno Drainer but has also experimented with Pink Drainer,” the investigator said.
<h2 id="strong-top-drainers-are-unplugging-strong">Top drainers are unplugging</h2>
Crypto drainers often work by exploiting vulnerabilities in smart contracts, phishing attacks, or through social engineering tactics to <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/phishing-crypto-erc-20-bait-scammers/" rel="null" target="null" text="null" title="null">gain access to wallets</a>.
They are created by developers who sell access to illicit actors, enabling them to conduct exploits and subsequent thefts in exchange for fees. This model has become known as the “<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/scam-as-a-service-new-solana-drainers-identified" rel="null" target="null" text="null" title="null">scam-as-a-service</a>” model.
“One mind shift that you need to make is that drainers are businesses,” Katz said. “If you actually look in the draining transactions, a big percentage goes to the person that deployed the drainer, because they take a commission.”
Over the years, these software tools have been marketed under their own brands, with services like Inferno, Pink and Monkey Drainer rising in popularity.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/blockaid-caused-crypto-drainer-shut-down-defends-against-claims-false-positives" rel="null" target="null" text="null" title="null">Blockaid says it caused crypto drainer to shut down, defends against claims of 'false positives</a>’
These three aren’t the only drainers around, but they do share a common trait. All of them have announced shutdowns, with Inferno the latest to unplug in October. Inferno claimed that its services have been taken over by Angel Drainer.
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/01934395-9ea8-7c84-b207-8bd531661e4d" title="">
 <figcaption style="text-align: center;">
 Inferno Drainer announced its services have been taken over by Angel Drainer in an Oct. 19 announcement. Source: <a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1847644659297788152" rel="null" target="null" text="null" title="null">Scam Sniffer</a>
 </figcaption>
</figure>
Monkey Drainer was one of the earliest to use the SaaS draining model. <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/notorious-monkey-drainer-crypto-scammer-says-they-re-shutting-down" rel="null" target="null" text="null" title="null">It shut down in March 2023</a>, then the next batch of drainers emerged, including Inferno and Pink.&nbsp;
Pink Drainer was allegedly developed by a former member of the security community who helped battle Monkey Drainer, then later <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/pink-drainer-security-researcher-steals-millions-from-participants/" rel="null" target="null" text="null" title="null">turned to the dark side</a>. Pink Drainer <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/pink-drainer-hacker-retirement-85m-theft" rel="null" target="null" text="null" title="null">announced its retirement in May 2024,</a> after amassing about $85 million from more than 21,000 victims.
Inferno was inactive after <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/inferno-drainer-shut-down-after-stealing-millions-crypto-wallet-scam-kit" rel="null" target="null" text="null" title="null">announcing its retirement in November 2023</a>, but<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/inferno-drainer-dapp-surge-crypto-scam-trends" rel="null" target="null" text="null" title="null"> resurfaced after Pink’s departure from the scene</a>.
Inferno’s latest shutdown was announced days after Tether froze the three wallets on Oct. 16, which was also the same day Cointelegraph Magazine’s investigation into Konpyl and the fake Rabby wallet was published.
<h2 id="strong-the-inferno-and-konpyl-connection-strong">The Inferno and Konpyl connection</h2>
Onchain evidence suggests a relationship between accounts linked to Konpyl and those associated with Inferno, although security experts have provided varying analyses on the specifics.
One sample onchain relationship comes from a draining incident in March 2024, when a victim lost $4.39 million in cryptocurrencies to a crypto thief equipped with Inferno Drainer’s set.
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/01934399-9736-7257-b26b-b389a1e64623" title="">
 <figcaption style="text-align: center;">
 Security community sniffs out an Inferno-linked draining attack and exposes illicit wallets used. (<a data-ct-non-breakable="null" href="https://x.com/realScamSniffer/status/1763394414549053527" rel="null" target="null" text="null" title="null">Scam Sniffer</a>)
 </figcaption>
</figure>
Some of the stolen tokens were <a data-ct-non-breakable="null" href="https://x.com/zachxbt/status/1763460072699756702" rel="null" target="null" text="null" title="null">burned</a> with the help of blockchain detective ZachXBT, but others were consolidated and travel to <a data-ct-non-breakable="null" href="https://etherscan.io/address/0x3444dc2ee8404284d081e7f826af3b35bc012ac3" rel="null" target="null" text="null" title="null">0x344…12ac3</a> which security firm MistTrack suspects is owned by Inferno Drainer. Here, around $767,610 in Wrapped Ether enters DeFi platform CoW Protocol.&nbsp;
On the other end, this amount is <a data-ct-non-breakable="null" href="https://etherscan.io/tx/0x3eb3cc887a52790be93c97e9e1edef6b7f6f9bbc96e5873ef7ce13d6e6d9efbd" rel="null" target="null" text="null" title="null">received by 0x87B…A53d92</a> (CoW Output) in Tether (USDT).
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/0193439a-0956-7366-8c02-43907654356e" title="">
 <figcaption style="text-align: center;">
 MistTracks’ analysis illustrated the consolidation of illicit funds. (<a data-ct-non-breakable="null" href="https://x.com/MistTrack_io/status/1784377481845232009" rel="null" target="null" text="null" title="null">MistTrack</a>)
 </figcaption>
</figure>
From this CoW output address, a relationship with Konpyl can be drawn. 
The output address has three transactions with <a data-ct-non-breakable="null" href="https://etherscan.io/address/0xF2FCFDC03C9F2EDB47466e724F457772A226a608" rel="null" target="null" text="null" title="null">0xF2F…6a608</a>, twice in August 2022 and once in May 2024. The first of the three transactions is the <a data-ct-non-breakable="null" href="https://etherscan.io/tx/0xd16db40ed6f4affd7e5c2f2c796d6d8c5ca811d4861b452fdd04315f7c1055c8" rel="null" target="null" text="null" title="null">funding transaction</a> for this 0xF2F wallet, or the first recorded transfer to that account.&nbsp;
0xF2F is tied to a Konpyl-linked account through seven transactions dating back to October 2023, totaling around half a million dollars, establishing the 0xF2F wallet as the bridge that connects the March 2024 Inferno Drainer-linked scheme and the entity linked to the 2024 fake Rabby wallet incident in this sample trail.
<h2 id="strong-unpacking-the-fund-movements-strong">Unpacking the fund movements</h2>
These movements, according to the private investigator, suggest that the entity known as Konpyl may be a major user of Inferno Drainer or have an even deeper involvement.
Still, Fantasy, investigation lead at crypto insurance firm Fairside Network, has a different take.
Fantasy told Cointelegraph that it’s also possible none of the wallets identified before entering CoW Protocol actually belong to Inferno Drainer. Rather, the wallets may all belong to Inferno Drainer customers.
“An Inferno customer would not willingly give up more of a theft. A more likely explanation is that this is a customer consolidating theft proceeds,” he told Cointelegraph, pointing to transactions that show draining fees were paid to a separate wallet.
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/0193439a-9cc2-7982-b9c5-6991816debee" title="">
 <figcaption style="text-align: center;">
 Fees paid to Inferno suggest that the subsequent movement could be made by an Inferno customer. (<a data-ct-non-breakable="null" href="https://etherscan.io/tx/0xc943ea893065cc7deac1a42d1670da1a9ebeb9fc1807bf3d835224dd499417cc" rel="null" target="null" text="null" title="null">Etherscan</a>)
 </figcaption>
</figure>
Fantasy also presented an alternative as to why Konpyl could be linked to the exploits.&nbsp;
“I wonder if he is an OTC [over-the-counter] trader and threat actors are using him to launder money. This may lead to an explanation as to why Konpyl’s Rhino outputs consolidate as they do,” Fantasy theorized, analyzing Konpyl’s onchain movements summarized by Cointelegraph Magazine’s October investigation.&nbsp;
“Concealing movements using OTC traders is not an uncommon tactic. Usually, these types of traders do not care where the funds originate from, as long as they receive their fee.”
<h2 id="strong-law-enforcement-and-security-experts-closing-the-gap-strong">Law enforcement and security experts closing the gap</h2>
Meanwhile, Fun, founder of Scam Sniffer, told Cointelegraph that continuous contributions by entities like MistTrack, Scam Sniffer and security group SEAL 911 are contributing to blacklisting illicit addresses.
<figure>
 <img alt="Crypto drainers are retiring as investigators start to close in" src="https://s3.cointelegraph.com/uploads/2024-11/0193439b-5e27-7bae-a84c-adde0f76b15b" title="">
 <figcaption style="text-align: center;">
 Security firm Blockaid questions whether Inferno Drainer is prepping to ride off into the sunset. (<a data-ct-non-breakable="null" href="https://x.com/blockaid_/status/1855995321110729010" rel="null" target="null" text="null" title="null">Blockaid</a>)
 </figcaption>
</figure>
Internet browser extensions like Kerberus also exist,&nbsp; while wallets are increasingly integrating user-security services like Blockaid.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/ethereum-phishing-drainers-ton-bitcoin/" rel="null" target="null" text="null" title="null">As Ethereum phishing gets harder, drainers move to TON and Bitcoin</a>
“For their safety, shutting down was inevitable,” Fun said. “Whether it’s Inferno Drainer or Pink Drainer, they’re just services used by scammers. The real perpetrators are hidden behind these drainer names.”
Still, Katz of Kerberus warns that shutdowns in the world of crypto drainers should be taken with a grain of salt, as they may be playing possum, much like Inferno’s “retirement” in November 2023, only to return and wreak havoc for half of 2024.
“They might say they shut down for security companies to lower their guard. But at the end of the day, they can rebrand under a new name [and] they can come back,” Katz said.
“These are criminals — let’s make that very clear. You can’t trust criminals no matter what they say.”

Crypto drainers are retiring as investigators start to close in

Table of Contents

Cointelegraph

Other articles published on Nov 19, 2024

MIGMIG Coin Price Surges 7% Today!

Shiba Inu co-founder criticizes Litecoin for its identity change

SOL Nears $260 Peak as Solana Leads Blockchain Ecosystems in 2024

Chromia Confirms Asgard Upgrade in December to Supercharge Its Layer 1 Blockchain

Injective AI Agent SDK Empowers Users To Build Onchain Agents

Landmark Decision for Lido DAO: What Does It Mean for LDO?

Join our free newsletter for daily crypto updates!