Dissecting an ingenious crypto wallet draining scam

By Investor Empires On Apr 18, 2023

A massive crypto wallet drain has been exposed, targeting experienced and industry-savvy crypto users since December 2022.

Over the past 48 hours I’ve been unwrapping a huge drain on my wallet 😳😭

I don’t know how big it is but since December 2022 5000+ ETH has been drained and ??? in Tokens/NFT/Currency across 11+ series.

It’s a record of my friends and OGs who are reasonably safe.

Nobody knows how. pic.twitter.com/MafntG7RkP

– Tay 💖 (@tayvano_) April 18, 2023

Draining over 5,000 Ethereum (ETH) and an unknown amount of tokens, non-fungible tokens (NFTs) and coins across 11+ chains, this scam has left the community searching for answers.

Let’s dive into the facts and data surrounding the process and its impact on the crypto community.

Decipher the way scammers operate

Attackers have been systematically draining the keys, possibly from a cache of data obtained over a year ago.

My best guess is that someone got hold of a data cache from over a year ago and is systematically draining the keys as they parse them from the treasure trove.

But this is just a guess. I don’t know.

It’s not about encryption/entropy, don’t waste your time.

– Tay 💖 (@tayvano_) April 18, 2023

They show distinct patterns in the heist and post-heist movement on the series, often moving assets between the addresses of several victims.

Major thefts in December 2022 used RenBridge, and the final destination for stolen assets is always Bitcoin (BTC).

Attackers use centralized swaps like FixedFloat, SimpleSwap, SideShift, ChangeNOW, and LetsExchange to launder money before moving it to privacy-focused mixers like Coinomize, Wasabi, and CryptoMixer.

6. “Out” is always a central swap like so:
float constant
SimpleSwap
lateral shift
change now
Let’s exchange
Unknown Swapper @ 0xca60
Other unnamed swaps nested on Binance

Major thefts were used on Dec 22 by Rainbridge

The final destination is always Bitcoin

LTC, XRP, XMR, etc. also move to BTC.

– Tay 💖 (@tayvano_) April 18, 2023

commonalities among the victims

The victims share some common characteristics, such as having their keys generated between 2014 and 2022 and being more cryptographically original than most (eg, having multiple addresses and working in space).

prospects, no one specified the source of their compromise.

Forensics have been performed on many devices. nothing.

The only known commonalities are:
– Keys were generated in the period 2014-2022
– People are more cryptocurrency natives than most (such as multiple addresses, work in space, etc.)

– Tay 💖 (@tayvano_) April 18, 2023

This scam has not affected any newbies; I specifically targeted experienced users with a single recovery secret phrase or private key.

To prevent such scams, the crypto community must prioritize education and awareness. Users should avoid keeping all assets in a single key or secret phrase and should migrate to hardware wallets.

Patterns in the timing of the robberies

Wallet drain displays strange patterns in the timing of the thefts. Many of the thefts appear to have occurred on weekends, with notable incidents on Sundays.

Extensive heists appear to have been scripted, and the dust left in the original title drained up to 80 days after the first title dried was stolen.

The IP addresses of attackers and user agents (UAs) are quite diverse, and they often use VPNs, proxies, and other methods to hide their true identity.

way ahead

By examining scammers’ tactics, victims’ commonalities, timing patterns, and understanding the importance of preventative measures, a community can better protect its assets.

Collaboration, education, and vigilance are critical to mitigating risk and restoring confidence in the security of digital assets.