Evolution of Drain Attacks

Evolution of Drain Attacks

Speakers: Utvecklas, George

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=Y3IohAauLfE

Overview

The talk "Evolution of Drain Attacks" by Utvecklas and George at DEF CON delves into the escalating sophistication of cryptocurrency drain attacks, a prevalent and financially devastating form of scam in the Web3 ecosystem. These attacks involve malicious smart contracts or phishing sites that trick victims into authorizing transactions, allowing attackers to transfer their digital assets, often under the guise of get-rich-quick schemes or other enticing incentives. The speakers meticulously chart the progression of these attacks from their rudimentary beginnings on the Ethereum blockchain to their current, highly advanced forms, impacting multiple chains and leveraging increasingly intricate social engineering and technical exploits.

This presentation is crucial for anyone involved in the blockchain space, from individual users and developers to security professionals and project founders. It highlights the dynamic cat-and-mouse game between attackers and defenders, showcasing how new blockchain features and user behaviors are continuously exploited. By providing a comprehensive overview of the technical mechanisms, deployment strategies, and the burgeoning "Draining as a Service" (DaaS) economy, the talk underscores the urgent need for enhanced user awareness, robust security protocols, and collaborative industry efforts to combat this evolving threat landscape. The insights shared are vital for understanding not only how these attacks work but also how to defend against them and, in some cases, recover stolen funds.

Background

▶ Watch: Explaining drain attacks and "set approval for all" exploit (0:00)

The genesis of drain attacks can be traced back to 2021 on the Ethereum blockchain, primarily exploiting the set approval for all method. This function, legitimately used by decentralized exchanges and marketplaces like OpenSea, allows a smart contract to spend a user's tokens on their behalf. Attackers quickly recognized its potential for abuse, deploying it on phishing sites where unsuspecting users would grant malicious contracts unlimited spending power over their ERC20 tokens. This initial vector was straightforward: approve the contract, and the attacker could empty the wallet of that specific token type.

The sophistication rapidly escalated. The EIP2612 permit function emerged as a more insidious method, enabling gasless approvals through seemingly innocent off-chain signatures. Unlike set approval for all, which requires a transaction and gas fee from the user, permit allows an attacker to craft malicious permits that never expire, with the attacker bearing the gas cost for the final token transfer. This made the initial approval appear less suspicious. What started as singular token draining of ERC20 tokens quickly evolved into multi-token draining with the advent of sophisticated drainers like Inferno Drainer, capable of requesting approvals for all tokens, including valuable NFTs and altcoins, in a single click, leading to reported losses exceeding $500,000 in some instances.

Further pushing the boundaries of compromise, the Pectra upgrade to Ethereum, introduced around 2025, brought EIP7702's off-chain set code message. This new feature, once signed, grants threat actors full control over a victim's wallet, enabling complete wallet takeovers—a significant escalation from mere token transfers. Beyond Ethereum, the attack surface expanded to other prominent blockchains. Solana became a target, uniquely allowing for the draining of native Solana tokens in addition to SPL tokens (Solana's equivalent of ERC20s). The TON network, Telegram's native blockchain, also fell victim, with attackers draining native TON and JetTONs (TON's ERC20 equivalent), often through fake safeguard bots or mini-apps.

The deployment methods for these drain attacks have also evolved in complexity and reach. Initially, they were prevalent in Discord takeovers, with hundreds of servers, including high-profile ones like Board Ape Yacht Club's Discord, being compromised monthly in 2021. This expanded to Twitter and Instagram takeovers, impersonating legitimate projects. Phishing sites became a primary vector, often promoted through Google Ads to appear as top search results for popular crypto websites, or circulated as replies on social media. A particularly deceptive method involved domain takeovers, as exemplified by prement.xyz, where a legitimate domain's registrar was hacked, and its name servers redirected to malicious ones. This meant users visiting the correct URL were still exposed to draining, highlighting the need for vigilance even on familiar sites. Attackers leverage registrars like Namecheap and Enom (due to their acceptance of cryptocurrency payments) and use Cloudflare for DDoS protection, though these services also offer avenues for reporting and takedown.

Key Findings

▶ Watch: New EIP7702 enables full wallet takeovers (3:00)

The talk's central revelation is the relentless and sophisticated evolution of drain attacks, showcasing a continuous arms race between malicious actors and the Web3 security ecosystem. Key findings illustrate several critical shifts and trends:

• Escalation of Exploitation Mechanisms: Drain attacks have progressed from basic set approval for all token permissions to advanced, gasless EIP2612 permit signatures, and most recently, to full wallet takeovers enabled by EIP7702's off-chain set code message. This trajectory signifies a move towards deeper, more comprehensive control over victim assets.
• Multi-Chain Proliferation: The threat is no longer confined to Ethereum. Attackers actively target other major blockchains, including Solana (draining native SOL and SPL tokens) and TON (draining native TON and JetTONs), demonstrating an adaptable and platform-agnostic approach to asset theft.
• Rise of Draining as a Service (DaaS): The emergence of DaaS platforms like Monkey Drainer, Pink Drainer, Inferno Drainer, and Angel Drainer has democratized sophisticated draining capabilities. This business model, involving a 20-30% cut for the developer and gamified leaderboards, significantly lowered the barrier to entry for attackers, leading to a surge in attack volume and innovation within the illicit ecosystem.
• Sophisticated Social Engineering and Infrastructure Compromise: Attackers employ a diverse array of vectors, including social media takeovers (Discord, X, Instagram), targeted phishing campaigns (via Google Ads, impersonation), and even domain takeovers where legitimate website infrastructure is compromised (e.g., prement.xyz), making detection extremely challenging for users.
• Persistent Cat-and-Mouse Dynamics: Despite defensive efforts by white hats and platforms (e.g., MetaMask warnings, OpenSea NFT flagging, project whitelisting), attackers consistently find new ways to circumvent protections (e.g., Blur marketplace for stolen NFTs, fake Revoke.cash sites). This highlights the need for continuous adaptation in defense strategies.
• Advanced Fund Laundering Techniques: Attackers utilize a complex web of services—including mixers like Tornado Cash (historically), instant cross-chain exchanges like FixedFloat, gambling sites such as Stake and Rollbit, and other avenues like Thoros Swap—to obfuscate stolen funds. Understanding these techniques is crucial for potential recovery efforts.

Technical Deep Dive

▶ Watch: Drain attacks expand to Solana and TON networks (3:38)

The technical underpinnings of drain attacks demonstrate a clever exploitation of legitimate blockchain functionalities and a keen understanding of user behavior.

At its core, the earliest form of drain attack on Ethereum leveraged the set approval for all ERC20 function. This function, typically found in token contracts, allows a designated address (e.g., a decentralized exchange or NFT marketplace) to spend any amount of a user's specified token. For instance, if a user wants to list an NFT on OpenSea, they might approve OpenSea's contract to manage their tokens. Malicious actors create phishing websites that mimic legitimate platforms. When a user connects their wallet and clicks an enticing "mint" or "claim" button, they are prompted to sign a transaction that calls set approval for all on a malicious contract. Once signed, this grants the attacker's contract unlimited power to transfer all tokens of that type from the victim's wallet.

A significant evolution came with the EIP2612 permit function. Unlike set approval for all, which requires an on-chain transaction from the user, permit allows for gasless approvals. Users sign an off-chain message using their private key, which grants a specific address permission to spend a certain amount of tokens. The beauty for attackers is that this signature can be embedded into an on-chain transaction later, with the attacker paying the gas fee. This makes the initial "signature" seem harmless and free, yet it can be crafted to grant perpetual spending approval, allowing the attacker to execute transfers at any time without further user interaction.

The most recent and alarming technical advancement is the exploitation of EIP7702, introduced with Ethereum's Pectra upgrade. This EIP introduces an offchain set code message that, when signed, allows the code associated with a user's address to be changed. In essence, signing this malicious EIP7702 message grants the attacker the ability to take over the entire wallet, not just specific token approvals. This represents a fundamental shift in the attack's severity, moving from asset-specific draining to complete wallet compromise.

The scope of drain attacks has also expanded across multiple blockchains, each with its unique token standards and vulnerabilities:

• Ethereum: Primarily targets ERC20 tokens and NFTs (ERC721, ERC1155), using the set approval for all, permit, and EIP7702 methods.
• Solana: A unique target because it allows for the draining of native Solana (SOL) tokens, not just wrapped or specialized tokens. Additionally, SPL tokens (Solana Program Library tokens), which are Solana's equivalent of ERC20s, are also targeted.
• TON (The Open Network): Telegram's blockchain is vulnerable to the draining of native TON coins and JetTONs (TON's equivalent of ERC20s). These attacks often leverage social engineering tactics within the Telegram ecosystem, such as fake safeguard bots or malicious mini-applications.

Deployment of these sophisticated drainers relies heavily on social engineering and infrastructure compromise:

• Social Media Takeovers: Attackers gain control of official Discord servers (e.g., Board Ape Yacht Club), X (Twitter), Instagram, or TikTok accounts. They then post malicious links or announcements, luring users to phishing sites. Discord Collab Land bots have also been exploited.
• Phishing Sites: These are meticulously crafted to mimic legitimate projects. They are disseminated via Google Ads (where attackers pay to have their malicious sites appear as top search results), direct messages, or replies impersonating official accounts on social media.
• Domain Takeovers: This advanced technique involves compromising a domain registrar (like Namecheap or Enom, often chosen for their crypto payment options) to change the name servers of a legitimate website (e.g., prement.xyz). Users visiting the correct URL are unknowingly redirected to an attacker-controlled server hosting the drainer, making it incredibly difficult to detect.
• Attacker Infrastructure: Attackers use typo-squatted or fake project domains registered with Namecheap or Enom. They often use Cloudflare for DDoS protection, which ironically also provides a centralized point for reporting and potential takedown if identified.

The rise of Draining as a Service (DaaS) has fundamentally changed the landscape. Innovators like Monkey Drainer developed sophisticated drainer source code and offered it to other threat actors, effectively democratizing the attacks. The business model involves a 20-30% cut of all stolen funds going back to the DaaS developer. This competitive market spurred further innovation, with other prominent DaaS platforms like Pink Drainer, Inferno Drainer, and Angel Drainer emerging, often incentivizing their users with gamified leaderboards on underground Telegram channels, fostering a culture of "flexing" stolen gains.

Finally, a critical component of the attacker's technical operation is money laundering. To obscure the trail of stolen funds and prevent freezing, attackers employ various methods:

• Mixers: Historically, services like Tornado Cash were used to obfuscate transaction histories.
• Instant Exchanges: Platforms like FixedFloat allow rapid, often cross-chain, conversion of assets, making tracing difficult.
• Gambling Sites: Funds are often moved through online gambling platforms such as Stake and Rollbit, further blending them with legitimate transactions.
• Other Avenues: Services like "The Watch King" and Bitrefill are also utilized.
• Cross-chain Swaps: While services like Thoros Swap facilitate chain-to-chain transfers, attackers sometimes overlook that Thoros Swap has its own explorer, which can be used by white hats to de-obfuscate the trail.

Demo / Proof of Concept

▶ Watch: Attacker domain tactics and how to report malicious sites (8:00)

The speakers highlighted that a comprehensive demonstration and technical analysis of drainers were available on their dedicated website, defcondemo.com. This resource provides attendees and the wider public with the opportunity to delve deeper into the mechanics of these attacks. Specifically, the website offers access to legitimate, real source code of drainers for technical dissection, allowing security researchers and developers to understand their inner workings. Furthermore, it includes working drainer pop-ups, giving users a visual understanding of what a malicious approval request looks like, albeit with a strong caution against authorizing any transactions.

During the live talk, an attempt was made to demonstrate the process of laundering funds and how to potentially de-obfuscate the trail using a block explorer. The scenario involved tracing 0.28 ETH stolen from a victim's wallet and moved to an attacker's wallet. The attacker would then attempt to obscure the trail by sending it to an instant exchange like FixedFloat to change chains. While a live demonstration on EtherScan to show how to use advanced filters to trace funds through FixedFloat was planned, it was unfortunately hindered by Wi-Fi issues at the conference. However, the methodology was clearly articulated: navigate to the relevant block explorer, identify transactions involving the instant exchange, and utilize advanced filtering options to follow the money's path, leveraging potential oversights by attackers, such as the existence of explorers for services like Thoros Swap.

Defensive Implications

▶ Watch: The rise of Draining as a Service (DaaS) and revenue models (9:00)

Combating the evolving landscape of drain attacks requires a multi-faceted approach, encompassing user education, robust platform security features, and collaborative industry efforts. Defenders must understand the attacker's methods to implement effective countermeasures.

For Individual Users:

The paramount defensive measure is user vigilance. Users must always check what they are signing off on, even when interacting with seemingly familiar domains. The prement.xyz domain takeover example clearly illustrates that a legitimate-looking URL does not guarantee safety. Users should be skeptical of "get-rich-quick" schemes and unexpected prompts. Tools like Revoke.cash are invaluable for removing old, potentially malicious token approvals, but users must be cautious of fake Revoke drainer websites that attempt to exploit this awareness. Before connecting a wallet or signing any transaction, users should verify the legitimacy of the website and the nature of the requested approval.

For Platforms and Developers:

• MetaMask Warnings: MetaMask has taken steps to mitigate drain attacks by introducing a warning popup in 2022 when a contract requests a set approval for all permission, alerting users to the high-risk nature of such actions.
• NFT Marketplace Security: OpenSea began flagging and freezing stolen NFTs, preventing their sale. However, attackers quickly adapted by moving to decentralized marketplaces like Blur, which allowed the trading of stolen assets. This highlights the need for a coordinated industry response across all marketplaces.
• Project Whitelisting: To combat phishing and malicious project launches, leading authorities like MetaMask, Phantom, and Blowfish now require new projects to seek approval and be whitelisted. Projects that fail to do so are red-flagged, providing an early warning for users.
• Integrated Security Services: The partnership between Blockade (a service that prevents draining) and MetaMask significantly disrupted the draining industry, leading to the shutdown of several prominent drainers, including Inferno Drainer. This demonstrates the power of integrating proactive security measures directly into wallet extensions.

Ecosystem Monitoring and Recovery:

• Community Awareness: Influencers and investigators like Zack XBT and NFT Herder play a crucial role on platforms like X (formerly Twitter) by conducting investigations and spreading awareness about ongoing scams.
• Security Services: Several services are dedicated to monitoring and reporting scams, including Wallet Guard, Blowfish, Rainbow Me, Web3IsGoingGreat.com, and Scam Sniffer. These resources provide up-to-date information on exploits and malicious activities.
• Fund Recovery (Post-Drain): If a user falls victim, immediate action is critical:

1. Contact the SEAL team: An intelligence team available 24/7 to assist with crypto-related scams.
2. Report to Exchanges: Immediately report stolen funds to any exchanges where they have been moved. If caught in time, exchanges may be able to freeze the funds and return them to the victim, provided proof and a police report are supplied.
3. Stablecoin Issuers: For stolen USDC or USDT, contact Circle or Tether directly. They have the ability to freeze tokens on their end with a police report.
4. Block Explorer Tagging: Reach out to EtherScan (or the relevant block explorer) to tag malicious contracts as "scamming/phishing" to prevent further victims.

• Tracing Stolen Funds: Understanding the attackers' money laundering techniques is vital. While mixers and instant exchanges complicate tracing, services like Thoros Swap have explorers that can sometimes be used to de-obfuscate trails, providing a potential avenue for recovery efforts.

Key Takeaways

• Rapid Evolution of Attack Vectors: Drain attacks are not static; they continuously evolve from simple set approval for all to gasless EIP2612 permit signatures and now to full wallet takeovers via EIP7702, demanding constant vigilance from users and developers.
• Democratization of Attacks by DaaS: The emergence of Draining as a Service (DaaS) platforms like Monkey Drainer has significantly lowered the technical barrier for attackers, leading to a proliferation of sophisticated scams and a competitive, gamified illicit economy.
• Multi-Chain Threat Landscape: The threat extends beyond Ethereum, actively targeting native assets and token standards on other major blockchains such as Solana and TON, requiring a broader security awareness across the Web3 ecosystem.
• Sophisticated Social Engineering and Infrastructure Exploitation: Attackers leverage advanced social engineering tactics, compromised social media accounts, phishing sites promoted by paid ads, and even domain takeovers to trick users, emphasizing the need for critical evaluation of all digital interactions.
• Continuous Cat-and-Mouse Game: Defensive measures, while crucial, are often quickly circumvented by new attack vectors or alternative platforms, highlighting the need for ongoing innovation in security tools, platform integrations (e.g., Blockade with MetaMask), and user education.
• Proactive Prevention and Post-Incident Recovery: While prevention through user vigilance and robust security tools is paramount, swift action, including reporting to specialized teams (SEAL team), exchanges, stablecoin issuers, and block explorers, can significantly increase the chances of fund recovery.

About the Speaker(s)

The talk "Evolution of Drain Attacks" was presented by Utvecklas and George Utlas. As speakers at DEF CON, a premier cybersecurity conference, they demonstrated their expertise and research into the rapidly evolving landscape of Web3 security threats, specifically focusing on the mechanisms, deployment, and impact of cryptocurrency drain attacks. Their presentation offered a detailed and analytical perspective on this critical area, contributing valuable insights to the broader security community.