A phishing attack connected to the Inferno Drainer toolkit, which takes advantage of malicious transactions to drain digital assets from the wallets of unwary victims, cost a cryptocurrency trader $1.28 million.
On October 14, a cryptocurrency trader who had signed a malicious transaction linked to a phishing attack in late September lost more than $1.28 million in digital assets.
According to blockchain intelligence firm Arkham, the attack was likely carried out using Inferno Drainer. The phishing-as-a-service toolkit has been responsible for hundreds of millions of dollars in stolen funds.
Phishing Attack Linked to Inferno Drainer Scam Service: How Did Victim Lose $1.28M?
After being duped into signing a phishing permit transaction, the investor, identified as “0xb0b..40c7,” had 108 billion PEPE, 73.8 million APU, and 165,000 MSTR tokens taken out of their wallet.
#PeckShieldAlert The address 0xb0b8…40c7 has been drained of ~$1.28M worth of cryptos, including 108B $PEPE, 73.8M $APU, and 165K $MSTR, after signing a #phishing permit signature.
— PeckShieldAlert (@PeckShieldAlert) October 14, 2024
The #phishing address #Fake_Phishing442846 is linked to the scammers who drained $32M worth of… pic.twitter.com/fq3a4DD0tD
The attack technique, referred to as a “approval phishing attack,” enables con artists to take over a victim’s wallet and move funds.
In this instance, the pilfered money was dispersed to several addresses under the attackers’ control over six transactions.
#PeckShieldAlert The address 0xb0b8…40c7 has been drained of ~$1.28M worth of cryptos, including 108B $PEPE, 73.8M $APU, and 165K $MSTR, after signing a #phishing permit signature.
— PeckShieldAlert (@PeckShieldAlert) October 14, 2024
The #phishing address #Fake_Phishing442846 is linked to the scammers who drained $32M worth of… pic.twitter.com/fq3a4DD0tD
Two weeks prior, “Fake_Phishing442846,” one of the wallets in question, was connected to another phishing attack where more than $32 million worth of spWETH tokens were taken.
By using the phishing toolkit, criminals can fabricate phony websites and applications that deceive users into giving them access to their wallets.
Inferno Drainer operates on a subscription model, charging scammers 30% for creating phishing websites and an additional 20% for each successful attack. According to Dune analytics data, the toolkit has facilitated the theft of over $237 million from more than 200,000 victims to date.
Although the developers announced plans to shut down Inferno Drainer in November 2023, the toolkit resurfaced in May 2024, driven by renewed demand from scammers.
Over $127 Million in Cryptocurrency Stolen in Q3 2024
Crypto investors are at serious risk from phishing attacks, which have cost them an estimated $2.7 billion since 2021, according to a Chainalysis report.
A venture capital fund lost $35 million in fwDETH tokens in a recent high-profile case, which resulted in a 90% decline in the token’s value.
Over $127 million in cryptocurrencies were stolen in Q3 2024 alone, with approximately $46 million lost in September. Web3 security firm Scam Sniffer reported that about 10,800 victims were affected by phishing attacks that month.
The largest incident occurred on September 28, when a permit phishing attack drained 12,083 spWETH, worth $32.43 million. The primary targets were Ether and other cryptocurrencies like Polygon (MATIC), BNB, and Optimism (OP).
Most phishing incidents stem from malicious links on social media and phishing ads on Google.