{"investigation":{"slug":"pink-drainer","entity_name":"Pink Drainer","trust_score":2,"severity_base":null,"score_modifier":0,"confidence":0.75,"status":"draft","content_type":"investigation","summary":"Pink Drainer was a pseudonymous wallet-drainer-as-a-service operation that supplied phishing kits and malicious smart-contract infrastructure to affiliate scammers between roughly April 2023 and May 2024. Security researchers, principally Scam Sniffer and blockchain investigator ZachXBT, attribute upward of $75-85 million in stolen crypto assets across an estimated 20,000-21,000+ victims to wallets and infrastructure linked to the group before it announced its retirement in May 2024. No law enforcement agency has publicly identified or charged the individuals behind the operation, so all attributions of activity and identity in this report come from private security researchers rather than courts or regulators.","sections":[{"content":"Pink Drainer was a \"drainer-as-a-service\" operation: rather than stealing funds directly, its pseudonymous operators built and rented out phishing infrastructure — fake websites, malicious smart contracts, and social-engineering scripts — to affiliate scammers, who used it to trick victims into signing transactions that transferred away their crypto assets. According to security researchers, drainer services of this kind typically required an upfront deposit from affiliates and then took a cut, commonly cited as 20-30%, of whatever an affiliate's campaign stole. The group's name derives from on-chain analysis: Scam Sniffer researchers reported that after tracing one victim's stolen assets, the receiving address resolved to the ENS domain \"pink-drainer.eth,\" which is how the group came to be labeled Pink Drainer. The operation was active from at least April 2023 and wound down in May 2024, during which time it became one of the most prolific wallet-drainer brands in the crypto phishing ecosystem alongside contemporaries like Inferno Drainer and the now-defunct Monkey Drainer.","heading":"Overview and Business Model","sources":[{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/","name":"Hackers steal $3 million by impersonating crypto news journalists (BleepingComputer)","type":"news_article","credibility":2},{"url":"https://www.theregister.com/2023/06/12/pink_drainer_crypto_scam/","name":"Pink Drainer crypto scam reporting (The Register)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","name":"Pink Drainer shutting down (The Block)","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Researchers describe several recurring attack patterns used by Pink Drainer and its affiliates. One well-documented method, reported by Scam Sniffer and covered by BleepingComputer, involved affiliates impersonating journalists from established crypto outlets such as Cointelegraph and Decrypt, spending one to three days building rapport with a target before requesting a \"podcast\" or \"interview\" appearance on Discord. Victims were directed to fake bot-verification pages that used a \"drag me to your bookmarks bar\" button to install a malicious JavaScript bookmarklet, which harvested Discord authentication tokens and let attackers hijack the account without needing a password or bypassing two-factor authentication directly. Compromised, trusted Discord and Twitter/X accounts were then used to push phishing links — often fake token airdrops, NFT mints, or \"verification\" prompts — to the account's followers. Once a victim connected a wallet and signed a malicious approval or \"increase allowance\" transaction, the drainer contract could transfer out tokens automatically, as in a reported December 2023 incident in which a single victim's 275,700 LINK tokens (about $4.3-4.4 million) were moved within roughly a minute of signing a malicious approval. Separately, in March 2024 an email phishing campaign that a security researcher linked to the Pink Drainer kit targeted creditors of bankrupt firms FTX and BlockFi, apparently using an email list originating from a prior breach of the email marketing service MailerLite, and was reported to have stolen at least $5 million from largely dormant claimant wallets.","heading":"Attack Methods and Technical Infrastructure","sources":[{"url":"https://drops.scamsniffer.io/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/","name":"Pink Drainer steals $3M from multiple hack events including OpenAI CTO, Orbiter Finance (Scam Sniffer)","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/","name":"Hackers steal $3 million by impersonating crypto news journalists (BleepingComputer)","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/pink-drainer-hackers-drain-4-4-million-in-link/","name":"Pink Drainer Hackers Drain $4.4 Million in LINK (CryptoPotato)","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam","name":"Chainlink: Pink Drainer's $4.4M crypto raid (Cointelegraph)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/284339/email-phishing-scam-targeting-blockfi-ftx-creditors-reels-in-millions-and-counting","name":"Email phishing scam targeting BlockFi, FTX creditors (The Block)","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Multiple individually reported incidents were attributed to Pink Drainer infrastructure by researchers and journalists. In June 2023, BleepingComputer and Scam Sniffer reported that Pink Drainer-linked phishing had compromised the Discord/Twitter accounts of 1,932 victims (some accounts put the figure near 2,300 by early June, rising through the month) via journalist-impersonation attacks, taking roughly $3 million in assets; reported targets or compromised-account chains in this wave included accounts associated with OpenAI CTO Mira Murati, musician Steve Aoki, and projects including Evmos, Pika Protocol, Orbiter Finance, LI.FI, Flare Network, Cherry Network, and Starknet. In September 2023, Ethereum co-founder Vitalik Buterin's X account was compromised via a SIM-swap attack against his mobile carrier and used to post a fake \"commemorative NFT\" link; on-chain analysis by security researchers linked the resulting theft of roughly $691,000-$700,000 in crypto and NFTs (including a CryptoPunk) to Pink Drainer software, though the SIM swap itself was a separate compromise of Buterin's phone number rather than a Pink Drainer technique. In December 2023, a single victim reportedly lost about $4.3-4.4 million in Chainlink (LINK) tokens to a phishing contract, with funds traced to wallets labeled \"PinkDrainer\" on Etherscan. As of a December 19, 2023 snapshot cited in press coverage, Dune Analytics data attributed to Scam Sniffer put cumulative Pink Drainer losses at about $18.7 million across roughly 9,068 victims to that point — a figure that grew substantially before the group's shutdown five months later.","heading":"Notable Incidents and High-Profile Targets","sources":[{"url":"https://www.business-standard.com/markets/cryptocurrency/hackers-impersonate-crypto-news-journalists-steal-3-mn-from-1-932-victims-123061200300_1.html","name":"Hackers impersonate crypto news journalists, steal $3 mn from 1,932 victims (Business Standard)","type":"news_article","credibility":1},{"url":"https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack","name":"Vitalik Buterin: SIM Swap Attack Behind $700,000 Twitter Hack (Decrypt)","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/pink-drainer-hackers-drain-4-4-million-in-link/","name":"Pink Drainer Hackers Drain $4.4 Million in LINK (CryptoPotato)","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam","name":"Chainlink: Pink Drainer's $4.4M crypto raid (Cointelegraph)","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Reported dollar figures for Pink Drainer's activity vary because they measure different time windows and different scopes of the operation, and no single audited total exists. The smallest figures — roughly $3 million from 1,932 victims (BleepingComputer, June 2023) and $3.3 million from about 2,300 victims since April 2023 (The Register, June 2023) — describe only the initial journalist-impersonation campaign observed in its first weeks. A mid-life snapshot cited in December 2023 coverage put cumulative losses, per a Scam Sniffer-linked Dune Analytics dashboard, at about $18.7 million from 9,068 victims. At the time of the group's May 2024 shutdown, the most widely cited lifetime figures diverge between approximately $75 million (Protos, citing \"over the past year,\" and several other outlets' initial reporting) and approximately $85 million (The Block, CryptoSlate, BeInCrypto, CryptoBriefing, CryptoTimes), both sourced to the same underlying Scam Sniffer/Dune Analytics dashboard (dune.com/scamsniffer/pinkdrainer-stats), which continued to update after the announcement as new addresses were attributed to the group — accounting for the $10 million spread between contemporaneous reports. Victim counts at shutdown are likewise reported inconsistently as \"over 20,000,\" \"nearly 20,000,\" and \"over 21,000\" across outlets citing the same dashboard. None of these totals have been independently audited by a court, regulator, or forensic accounting firm; they represent researcher estimates built from on-chain wallet clustering and should be read as approximate.","heading":"Scale of Theft: Reconciling the Reported Totals","sources":[{"url":"https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","name":"Pink Drainer 'steps back from the grind' after stealing $75M from victims (Protos)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","name":"Crypto wallet drainer linked to $85 million in thefts shuts down (The Block)","type":"news_article","credibility":1},{"url":"https://cryptoslate.com/infamous-crypto-scam-service-pink-drainer-shuts-down-after-netting-85-million/","name":"Infamous crypto scam service Pink Drainer shuts down after netting $85 million (CryptoSlate)","type":"news_article","credibility":2},{"url":"https://beincrypto.com/pink-drainer-shuts-down/","name":"Pink Drainer Shuts Down After Stealing $85 Million in Crypto (BeInCrypto)","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/","name":"Pink Drainer Loses 10 Ether to Address Poisoning Scam (CryptoTimes)","type":"news_article","credibility":2},{"url":"https://dune.com/scamsniffer/pinkdrainer-stats","name":"Pink Drainer Scam Stats dashboard (Dune Analytics / Scam Sniffer)","type":"on_chain","credibility":2}],"severity":"critical"},{"content":"The individuals operating Pink Drainer have never been publicly identified by any court, regulator, or law enforcement agency. Nearly all attribution — the group's name, its wallet clusters, its victim and loss totals, and news of its shutdown — traces back to private security researchers, principally the Web3 anti-scam firm Scam Sniffer and pseudonymous on-chain investigator ZachXBT, who first surfaced the group's May 2024 retirement message from a private Telegram channel. No named individual has been confirmed as an operator, and this report does not name any suspected individual, consistent with the pseudonymous and unproven nature of the attribution. Commentary on the group's future legal exposure has itself come from researchers rather than authorities: SlowMist founder Yu Xian was reported to have said that \"retirement\" may not shield the operators, citing the volume of on-chain records law enforcement could eventually use, and voicing hope the group would eventually be caught. As of the most recent available reporting, a review of public federal records found no announced DOJ or FBI indictment specifically naming Pink Drainer's core developers; broader wire-fraud, computer-fraud, and money-laundering statutes could in principle apply if investigators identified individuals, but no such identification has been made public. Readers should treat all identity, scale, and attribution claims in this report as researcher assessments, not judicial or regulatory findings.","heading":"Operator Identity, Attribution, and Law Enforcement Status","sources":[{"url":"https://cryptobriefing.com/pink-drainer-shutdown/","name":"Pink Drainer shuts down after dealing over $85 million in damage (CryptoBriefing)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","name":"Crypto wallet drainer linked to $85 million in thefts shuts down (The Block)","type":"news_article","credibility":1},{"url":"https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","name":"Pink Drainer 'steps back from the grind' after stealing $75M from victims (Protos)","type":"news_article","credibility":2}],"severity":"high"},{"content":"On May 17, 2024, blockchain investigator ZachXBT reported that Pink Drainer had announced its retirement in a private Telegram channel, stating it had \"reached our goal now, and according to plan, it's time for us to retire,\" and that it would wipe and securely destroy stored data with no plans to return. Coverage timestamps the disclosure precisely: one outlet logged its report at \"2:56AM EDT (updated 3:41AM EDT)\" on May 17, 2024, and a related social post citing the announcement was timestamped \"2:09 PM \\u2022 May 17, 2024.\" The retirement message reportedly apologized to the operation's paying affiliates for the lack of advance notice while expressing no remorse toward victims, and separately advised other scammers to \"take a step back from the grind and enjoy what this world has to offer.\" The group's associated Telegram channel was subsequently reported to have been rebranded to \"Bonadifier.\" Despite the announced shutdown, on-chain activity attributed to Pink Drainer-linked wallets continued to be observed afterward: in a case reported by MistTrack and covered by multiple outlets, a wallet linked to the group lost 10 ETH (roughly $30,000) to an address-poisoning scam in late June 2024, when scammers tricked the group into sending funds to a look-alike address, a detail widely reported with some irony given the group's own history of tricking victims. Security firm SlowMist also reported that a substantial share of the group's holdings, including two wallets equivalent to roughly 1.3% of the total supply of MakerDAO's sDAI, had been converted into that interest-bearing stablecoin, and later reporting noted lingering wallets still holding an estimated $12 million in assets after the announced closure.","heading":"Shutdown Announcement and Post-Closure Activity","sources":[{"url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","name":"Crypto wallet drainer linked to $85 million in thefts shuts down (The Block)","type":"news_article","credibility":1},{"url":"https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","name":"Pink Drainer 'steps back from the grind' after stealing $75M from victims (Protos)","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/","name":"Pink Drainer Loses 10 Ether to Address Poisoning Scam (CryptoTimes)","type":"news_article","credibility":2},{"url":"https://crypto.news/wallet-drainer-service-pink-drainer-to-wind-down-operations/","name":"Wallet drainer service Pink Drainer to wind down operations (crypto.news)","type":"news_article","credibility":2}],"severity":"high"},{"content":"Blockchain explorers and security researchers have publicly labeled several Ethereum and BNB Chain addresses as associated with Pink Drainer's operator or fee-collection wallets, including addresses tagged on Etherscan such as 0x63605e53d422c4f1ac0e01390ac59aaf84c44a51, 0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726, and 0xa5e4b451d0a3c3d05fc3a8076fda45952b8f4f83, and a corresponding address tracked on BscScan. These labels derive from community and researcher tagging (e.g., Etherscan's public label system and Scam Sniffer's tracking) rather than from a confirmed operator disclosure, and should be treated as researcher attribution rather than proven ownership. Reporting on specific incidents shows a consistent laundering pattern: stolen tokens were typically swapped into ETH shortly after theft and, according to SlowMist and other trackers, a significant share of proceeds was subsequently converted into MakerDAO's sDAI, an interest-bearing stablecoin, with the group's holdings at one point representing roughly 1.3% of total sDAI supply. In the December 2023 Chainlink incident, stolen LINK was split between a wallet Etherscan labels \"PinkDrainer: Wallet 2\" and a separate address, with proceeds reportedly later moved through the no-KYC exchange eXch. These fund-flow claims come from blockchain analytics firms and on-chain sleuths rather than from any subpoenaed exchange record or law enforcement seizure.","heading":"On-Chain Addresses and Fund Flows","sources":[{"url":"https://etherscan.io/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","name":"Etherscan address 0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","type":"on_chain","credibility":2},{"url":"https://etherscan.io/address/0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726","name":"Etherscan address 0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726","type":"on_chain","credibility":2},{"url":"https://etherscan.io/address/0xa5e4b451d0a3c3d05fc3a8076fda45952b8f4f83","name":"Etherscan address 0xa5e4b451d0a3c3d05fc3a8076fda45952b8f4f83","type":"on_chain","credibility":2},{"url":"https://bscscan.com/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","name":"BscScan address 0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","type":"on_chain","credibility":2},{"url":"https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","name":"Pink Drainer 'steps back from the grind' after stealing $75M from victims (Protos)","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam","name":"Chainlink: Pink Drainer's $4.4M crypto raid (Cointelegraph)","type":"news_article","credibility":2}],"severity":"high"},{"content":"Pink Drainer operated within a broader \"drainer-as-a-service\" industry that researchers say collectively caused hundreds of millions of dollars in losses across 2023 and 2024. Contemporaries and successors named in coverage include Inferno Drainer and Monkey Drainer, both of which also ceased or reduced operations around similar periods, with commentary framing Pink Drainer's May 2024 exit as part of a broader (if temporary) contraction in the drainer market later followed by renewed activity from other services. A Scam Sniffer report covering calendar year 2024 found that wallet drainers as a category stole approximately $494 million from more than 300,000 wallet addresses that year, a 67% increase over 2023, including 30 individual thefts exceeding $1 million and one single heist of $55.4 million; the same report found the Inferno Drainer service alone responsible for roughly $110 million in losses across August and September 2024, illustrating that the drainer-as-a-service model persisted and scaled after Pink Drainer's exit rather than disappearing with it.","heading":"Ecosystem Context and Relationship to Other Drainer Services","sources":[{"url":"https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","name":"Scam Sniffer 2024: Web3 Phishing Attacks - Wallet Drainers Drain $494 Million (Scam Sniffer)","type":"research","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","name":"Cryptocurrency wallet drainers stole $494 million in 2024 (BleepingComputer)","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Coverage of Pink Drainer incidents highlights recurring warning signs consistent with wallet-drainer campaigns generally: unsolicited \"journalist\" or \"podcast\" interview requests on Discord or Twitter/X that pressure a quick video call or link click; prompts to \"drag\" a browser bookmarklet to verify identity or pass a bot check (a technique used to install token-stealing JavaScript rather than a legitimate verification step); surprise \"commemorative\" or free NFT mint links posted from otherwise trustworthy, high-follower accounts (a pattern seen in the Vitalik Buterin account compromise); and wallet approval or \"increase allowance\" transaction prompts that are not clearly explained by the requesting site. Security researchers have generally recommended revoking unused token approvals, treating unsolicited DMs and interview requests with skepticism regardless of the apparent outlet, and never connecting a wallet or signing a transaction on a page reached via a link from an unverified source, though these are general industry practices rather than claims specific to any single Pink Drainer statement.","heading":"Prevention and Red Flags","sources":[{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/","name":"Hackers steal $3 million by impersonating crypto news journalists (BleepingComputer)","type":"news_article","credibility":2},{"url":"https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack","name":"Vitalik Buterin: SIM Swap Attack Behind $700,000 Twitter Hack (Decrypt)","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-04","event":"Security researchers first observe activity later attributed to the wallet-drainer operation that became known as Pink Drainer.","source":"The Register","source_url":"https://www.theregister.com/2023/06/12/pink_drainer_crypto_scam/"},{"date":"2023-06","event":"The Register reports that Pink Drainer stole approximately $3.3 million from about 2,300 victims via Discord-based journalist-impersonation phishing since April 2023, and explains that the group's name derives from a stolen-funds address resolving to the ENS domain pink-drainer.eth.","source":"The Register","source_url":"https://www.theregister.com/2023/06/12/pink_drainer_crypto_scam/"},{"date":"2023-06","event":"BleepingComputer and Business Standard report that Pink Drainer-linked phishing compromised 1,932 victims' Discord/Twitter accounts, stealing roughly $3 million, with targets reportedly including accounts connected to OpenAI CTO Mira Murati, Steve Aoki, Orbiter Finance, and Starknet.","source":"BleepingComputer / Business Standard","source_url":"https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/"},{"date":"2023-09-09","event":"Vitalik Buterin's X account is compromised via a SIM-swap attack on his phone carrier and used to post a fake commemorative NFT link; on-chain analysis links the roughly $691,000-$700,000 in resulting thefts to Pink Drainer software.","source":"Decrypt","source_url":"https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack","date_evidence":"On September 9, 2023, Dmitry Buterin, Vitalik's father, announced the hack."},{"date":"2023-12","event":"A single victim reportedly loses about $4.3-4.4 million in Chainlink (LINK) tokens to a Pink Drainer-linked phishing contract; a Dune Analytics dashboard cited in coverage puts cumulative losses at roughly $18.7 million across about 9,068 victims as of December 19, 2023.","source":"CryptoPotato / Cointelegraph","source_url":"https://cryptopotato.com/pink-drainer-hackers-drain-4-4-million-in-link/"},{"date":"2024-03","event":"An email phishing campaign linked by a security researcher to the Pink Drainer kit targets creditors of bankrupt firms FTX and BlockFi, reportedly using a leaked MailerLite email list, resulting in at least $5 million in reported thefts.","source":"The Block","source_url":"https://www.theblock.co/post/284339/email-phishing-scam-targeting-blockfi-ftx-creditors-reels-in-millions-and-counting"},{"date":"2024-05-17","event":"ZachXBT reports that Pink Drainer announced its retirement in a private Telegram channel, stating it had reached its goal, would wipe stored data, and would not return; press coverage cites cumulative theft figures ranging from about $75 million to $85 million across roughly 20,000-21,000+ victims.","source":"The Block","source_url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","date_evidence":"Announcement Date: May 17, 2024, 2:56AM EDT (updated 3:41AM EDT)"},{"date":"2024-06","event":"A wallet linked to Pink Drainer reportedly loses 10 ETH (about $30,000) to an address-poisoning scam after being tricked into sending funds to a look-alike wallet address, according to blockchain compliance platform MistTrack.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/"},{"date":"2024-07","event":"CryptoTimes and other outlets report on the address-poisoning loss and reiterate that Pink Drainer's lifetime theft total is estimated at $85.3 million since it began operating in July 2023 per the researchers' dashboard, alongside its May 17 retirement announcement.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/"},{"date":"2024","event":"Wallet-drainer services as a category, including Inferno Drainer, continue and scale up operations after Pink Drainer's exit; a Scam Sniffer report finds drainers stole about $494 million industry-wide in 2024, a 67% increase over 2023.","source":"Scam Sniffer / BleepingComputer","source_url":"https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/"}],"sources_used":[{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/","name":"Hackers steal $3 million by impersonating crypto news journalists (BleepingComputer)","type":"news_article","archive_url":"http://web.archive.org/web/20250929190926/https://www.bleepingcomputer.com/news/cryptocurrency/hackers-steal-3-million-by-impersonating-crypto-news-journalists/","credibility":2,"archive_timestamp":"2025-09-29T19:09:26+00:00"},{"url":"https://www.theregister.com/2023/06/12/pink_drainer_crypto_scam/","name":"Pink Drainer crypto scam reporting (The Register)","type":"news_article","archive_url":"http://web.archive.org/web/20260117041551/https://www.theregister.com/2023/06/12/pink_drainer_crypto_scam/","credibility":2,"archive_timestamp":"2026-01-17T04:15:51+00:00"},{"url":"https://www.business-standard.com/markets/cryptocurrency/hackers-impersonate-crypto-news-journalists-steal-3-mn-from-1-932-victims-123061200300_1.html","name":"Hackers impersonate crypto news journalists, steal $3 mn from 1,932 victims (Business Standard)","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://drops.scamsniffer.io/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/","name":"Pink Drainer steals $3M from multiple hack events including OpenAI CTO, Orbiter Finance (Scam Sniffer)","type":"research","archive_url":"http://web.archive.org/web/20260821123033/https://drops.scamsniffer.io/pink-drainer-steals-3m-from-multiple-hack-events-including-openai-cto-orbiter-finance/","credibility":2,"archive_timestamp":"2026-08-21T12:30:33+00:00"},{"url":"https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack","name":"Vitalik Buterin: SIM Swap Attack Behind $700,000 Twitter Hack (Decrypt)","type":"news_article","archive_url":"http://web.archive.org/web/20260513153711/https://decrypt.co/156000/vitalik-buterin-sim-swap-attack-behind-700000-twitter-hack","credibility":2,"archive_timestamp":"2026-05-13T15:37:11+00:00"},{"url":"https://cryptopotato.com/pink-drainer-hackers-drain-4-4-million-in-link/","name":"Pink Drainer Hackers Drain $4.4 Million in LINK (CryptoPotato)","type":"news_article","archive_url":"http://web.archive.org/web/20250917080643/https://cryptopotato.com/pink-drainer-hackers-drain-4-4-million-in-link/","credibility":2,"archive_timestamp":"2025-09-17T08:06:43+00:00"},{"url":"https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam","name":"Chainlink: Pink Drainer's $4.4M crypto raid (Cointelegraph)","type":"news_article","archive_url":"http://web.archive.org/web/20260415185703/https://cointelegraph.com/news/chainlink-pink-drainer-crypto-phishing-scam","credibility":2,"archive_timestamp":"2026-04-15T18:57:03+00:00"},{"url":"https://www.theblock.co/post/284339/email-phishing-scam-targeting-blockfi-ftx-creditors-reels-in-millions-and-counting","name":"Email phishing scam targeting BlockFi, FTX creditors (The Block)","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/295041/pink-drainer-shutting-down","name":"Crypto wallet drainer linked to $85 million in thefts shuts down (The Block)","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","name":"Pink Drainer 'steps back from the grind' after stealing $75M from victims (Protos)","type":"news_article","archive_url":"http://web.archive.org/web/20260420055859/https://protos.com/pink-drainer-steps-back-from-the-grind-after-stealing-75m-from-victims/","credibility":2,"archive_timestamp":"2026-04-20T05:58:59+00:00"},{"url":"https://cryptoslate.com/infamous-crypto-scam-service-pink-drainer-shuts-down-after-netting-85-million/","name":"Infamous crypto scam service Pink Drainer shuts down after netting $85 million (CryptoSlate)","type":"news_article","archive_url":"http://web.archive.org/web/20260724175500/https://cryptoslate.com/infamous-crypto-scam-service-pink-drainer-shuts-down-after-netting-85-million/","credibility":2,"archive_timestamp":"2026-07-24T17:55:00+00:00"},{"url":"https://beincrypto.com/pink-drainer-shuts-down/","name":"Pink Drainer Shuts Down After Stealing $85 Million in Crypto (BeInCrypto)","type":"news_article","archive_url":"http://web.archive.org/web/20240928193829/https://beincrypto.com/pink-drainer-shuts-down/","credibility":2,"archive_timestamp":"2024-09-28T19:38:29+00:00"},{"url":"https://cryptobriefing.com/pink-drainer-shutdown/","name":"Pink Drainer shuts down after dealing over $85 million in damage (CryptoBriefing)","type":"news_article","archive_url":"http://web.archive.org/web/20260211212634/https://cryptobriefing.com/pink-drainer-shutdown/","credibility":2,"archive_timestamp":"2026-02-11T21:26:34+00:00"},{"url":"https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/","name":"Pink Drainer Loses 10 Ether to Address Poisoning Scam (CryptoTimes)","type":"news_article","archive_url":"http://web.archive.org/web/20260725041056/https://www.cryptotimes.io/2024/07/08/pink-drainer-loses-10-ether-to-address-poisoning-scam/","credibility":2,"archive_timestamp":"2026-07-25T04:10:56+00:00"},{"url":"https://crypto.news/wallet-drainer-service-pink-drainer-to-wind-down-operations/","name":"Wallet drainer service Pink Drainer to wind down operations (crypto.news)","type":"news_article","archive_url":"http://web.archive.org/web/20251008163008/https://crypto.news/wallet-drainer-service-pink-drainer-to-wind-down-operations/","credibility":2,"archive_timestamp":"2025-10-08T16:30:08+00:00"},{"url":"https://dune.com/scamsniffer/pinkdrainer-stats","name":"Pink Drainer Scam Stats dashboard (Dune Analytics / Scam Sniffer)","type":"on_chain","archive_url":"http://web.archive.org/web/20251009230424/https://dune.com/scamsniffer/pinkdrainer-stats","credibility":2,"archive_timestamp":"2025-10-09T23:04:24+00:00"},{"url":"https://etherscan.io/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","name":"Etherscan address 0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","type":"on_chain","archive_url":"http://web.archive.org/web/20260210023402/https://etherscan.io/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","credibility":2,"archive_timestamp":"2026-02-10T02:34:02+00:00"},{"url":"https://etherscan.io/address/0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726","name":"Etherscan address 0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726","type":"on_chain","archive_url":"http://web.archive.org/web/20260724175752/https://etherscan.io/address/0x9fa7bb759641fcd37fe4ae41f725e0f653f2c726","credibility":2,"archive_timestamp":"2026-07-24T17:57:52+00:00"},{"url":"https://etherscan.io/address/0xa5e4b451d0a3c3d05fc3a8076fda45952b8f4f83","name":"Etherscan address 0xa5e4b451d0a3c3d05fc3a8076fda45952b8f4f83","type":"on_chain","archive_url":"http://web.archive.org/web/20260219150630/https://etherscan.io/address/0xA5e4B451D0A3C3D05Fc3A8076fda45952b8f4F83","credibility":2,"archive_timestamp":"2026-02-19T15:06:30+00:00"},{"url":"https://bscscan.com/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","name":"BscScan address 0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","type":"on_chain","archive_url":"http://web.archive.org/web/20260724174822/https://bscscan.com/address/0x63605e53d422c4f1ac0e01390ac59aaf84c44a51","credibility":2,"archive_timestamp":"2026-07-24T17:48:22+00:00"},{"url":"https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","name":"Scam Sniffer 2024: Web3 Phishing Attacks - Wallet Drainers Drain $494 Million (Scam Sniffer)","type":"research","archive_url":"http://web.archive.org/web/20260526031858/https://drops.scamsniffer.io/scam-sniffer-2024-web3-phishing-attacks-wallet-drainers-drain-494-million/","credibility":2,"archive_timestamp":"2026-05-26T03:18:58+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","name":"Cryptocurrency wallet drainers stole $494 million in 2024 (BleepingComputer)","type":"news_article","archive_url":"http://web.archive.org/web/20260308104644/https://www.bleepingcomputer.com/news/security/cryptocurrency-wallet-drainers-stole-494-million-in-2024/","credibility":2,"archive_timestamp":"2026-03-08T10:46:44+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T16:05:04.835587+00:00","updated_at":"2026-09-01T04:16:58.939378+00:00"}}