This is a phishing scam that happened recently where the victim lost about 150K in LINK, CBETH, and ILV. Most of the funds are still sitting in decentralized wallets.

50k+ went to an eXch deposit address. I can only assume the rest of the victim’s funds will end up there as well.

The Wallets

Victim Wallet

0x373aDc79FF63d5076D0685cA35031339d4E0Da82 – 150K Phishing Victim

Scammer Wallets

0x4f4314e1E81650497D46e5b2179f5F3430902011 – 150K Scammer 0xd93786Dfb7A8c399e063c8e695C0efb3ACb6da9b – 150K Scammer 1 0xafC584057969fdeA6F07E4c7B6E1f4E799Bd964D – 150K Scammer 1 1 [74K here] 0x3B6e65D82B5828e5539ADB63A9cBe7F35F7f780E- 150K Scammer 2 0x8470C613Bcd6866019487d8fC58cCcB23e4af0C2- 150K Scammer 2 1 0x9fA7bB759641FCd37fe4aE41f725e0f653f2C726 – Pink Drainer

Deposit Addresses

0xf1dA173228fcf015F43f3eA15aBBB51f0d8f1123 – eXch [About 50k sent here]

Mapping of the Scam

Above is a trace of all the wallets. So far, only a portion of the funds have been sent to deposit addresses (eXch).

How the Phishing Scam Works

Pink Drainer is a Scam as a Service platform that drains victims wallets once a user signs a malicious contract. It’s becoming more popular with the “retirement” of other wallet drainers like Inferno.

The victim goes to a scam website, clicks on the link, and gives permission to connect your hot wallet. Once that is done, Pink Drainer springs into action, draining any and all assets in the wallet. Starting of course with the token with the most assets and going down from there.

Pink Drainer takes 20%+ and the rest goes into the scammers wallet. You can see the process in the image below.

Above is victim’s funds getting dispersed between Pink Drainer and the scammer’s wallet. Pink Drainer takes a % of funds, usually 20%, before sending the rest to the scammer’s fresh wallet.

Wallet of Interest

Whenever I look at these scams/hacks I like to look at all connections. I did notice a Twitter account connected to one of the wallets interacting with the scammer’s wallet.

0x56850f01f997A6FAE6533cFFcd036CC6c0D659a7 could very well be a victim as well. It’s worth investigating a bit more.

Above is a look inside 0x4f4314e1E81650497D46e5b2179f5F3430902011. The label “filip_eek” is a wallet of interest with the two interactions. This could also be a victim losing RPL and PEPE. It’s worth investigating further.

Thanks for reading!

​