Pengfei.eth Link Phishing Inferno Drainer - Revision history

Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pengfeiethlinkphishinginfernodrainer.php}} {{Unattributed Sources}} Inferno DrainerPengfei.eth became an unfortunate Inferno Drainer victim, sending $137k worth of LINK to a phishing website, where it was split between a scammer and the software developer. It is unclear if any investigation is underway or any funds will be recovered.
2024-09-18T21:04:22Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pengfeiethlinkphishinginfernodrainer.php}} {{Unattributed Sources}} thumb|Inferno DrainerPengfei.eth became an unfortunate Inferno Drainer victim, sending $137k worth of LINK to a phishing website, where it was split between a scammer and the software developer. It is unclear if any investigation is underway or any funds will be recovered.<ref name="chainaegi..."

New page
{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/pengfeiethlinkphishinginfernodrainer.php}}
{{Unattributed Sources}}

[[File:Infernodrainer.jpg|thumb|Inferno Drainer]]Pengfei.eth became an unfortunate Inferno Drainer victim, sending $137k worth of LINK to a phishing website, where it was split between a scammer and the software developer. It is unclear if any investigation is underway or any funds will be recovered.<ref name="chainaegistwitter-14527" /><ref name="chainaegisapp-14528" /><ref name="etherscan-14529" /><ref name="bitraceteamtwitter-14530" /><ref name="groupibmedium-14531" /><ref name="therecord-14532" /><ref name="infernodrainertelegram-14533" /><ref name="cointelegraph-14534" /><ref name="infernodrainerarchive-14535" /><ref name="dfgdfgqgarchive-14536" /><ref name="infernodrainerarchive-14537" /><ref name="groupib-14538" /><ref name="cryptoslate-14539" /><ref name="nftnewstoday-14540" /><ref name="cryptoslate-14541" /><ref name="plumfernotwitter-14542" /><ref name="decrypt-14543" /><ref name="coinmonksmedium-14544" /><ref name="dune-14545" />

== About Pengfei.eth ==
https://opensea.io/0x98f654450c796a41b76cb2a3731bf22ab5d32da9/deals
https://holesky.ethplorer.io/address/0x98f654450c796a41b76cb2a3731bf22ab5d32da9
https://etherscan.io/address/0x98f654450c796a41b76cb2a3731bf22ab5d32da9
https://app.zerion.io/0x98f654450c796a41b76cb2a3731bf22ab5d32da9/overview
== About Inferno Drainer ==
"A new type of scam software called “drainers” recently appeared in the wild. The first attacks involving this malware made headlines in late 2022. The damage they caused accounted for a “petty” few dozen million US dollars. However, in just a few months, the situation changed drastically: spurred on by their initial successes, threat actors behind wallet drainers stole almost USD 300 million in 2023. Much of that can be attributed to a player called Inferno Drainer, whose activity, ScamSniffer estimates, led to more than USD 80 million being stolen — the biggest sum siphoned by one drainer so far.

The Inferno Drainer developers created their Telegram channel in November 2022. From December 2022 to February of the following year, Inferno Drainer launched a major advertising campaign on Telegram. Although the gang announced that Inferno Drainer was shutting down operations in November 2023, the user panel related to the software developers is still available to past clients, who continue to attack crypto wallet owners to this day."

"Although the service was shut down, the Inferno Drainer scheme continues to pose a threat because its former users are likely to have shifted to new fraudulent activities. Its customers have access to the Inferno Drainer infrastructure and are hungry for easy money. The success that the criminal developers have enjoyed is expected to inspire future waves of similar tools."

"Inferno Drainer operated 689 phishing websites targeting various popular projects, exploiting vulnerabilities in the decentralized nature of cryptocurrency transactions. Reports indicate that nearly 4,888 victims have fallen prey to these scams, suffering substantial financial losses."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"Address 0x4fcF...d75c fallen victim to a phishing scheme, and lost ～$137K worth of $LINK."
{| class="wikitable"
|+Key Event Timeline - Pengfei.eth Link Phishing Inferno Drainer
!Date
!Event
!Description
|-
|November 26th, 2023 4:58:00 PM MST
|CoinTelegraph Reports ShutDown
|CoinTelegraph reports that the InfernoDrainer software has announced their shutdown.
|-
|January 18th, 2024 9:18:47 AM MST
|Report On ShutDown
|A report is published on the supposed shutdown of the InfernoDrainer software.
|-
|May 21st, 2024 7:42:00 AM MDT
|Inferno Drainer Relaunched
|Inferno Drainer reportedly relaunches after being offline since November. The service reportedly phished $125m privately during the downtime.
|-
|June 30th, 2024 10:56:47 PM MDT
|Blockchain Transaction
|The blockchain transaction draining the wallet.
|-
|July 1st, 2024 2:55:00 AM MDT
|ChainAegis Tweet
|ChainAegis shares a tweet about the phishing attack with analysis.
|-
|July 2nd, 2024 9:31:00 AM MDT
|Bitrace Discussion
|Bitrace discusses the InfernoDrainer addresses which have received an estimated $28m in funds.
|}

== Technical Details ==
"From 0x4fcFdda0...a7227d75c To Fake_Phishing324039 For 1,681.63256625 $24,366.86 ChainLink To... (LINK)"

"From 0x4fcFdda0...a7227d75c To 0x82AE0340...31c67C636 For 7,927.69638375 $114,872.32 ChainLink To... (LINK)"

"The drainer would then check the minimum wallet value. If the assets amounted to less than $100, a transaction was not initiated until the wallet was recharged. Once a sufficient amount was available, the drainer selected the victim’s most valuable and easiest to transfer assets and initialized a transaction. If the victim confirmed the transfer manually, their assets were sent to criminals’ addresses and split 20/80 between the developer and the customer."

"The reason the scam service broke the record as regards the amount of stolen money was the mass nature of its activity. The multichain drainer siphoned assets across many crypto networks and its customers attacked users through compromised social media accounts and promotion campaigns more aggressively than all its predecessors: there were more than 134,000 victims. By comparison, the second most notable drainer, called MS Drainer, affected half as many victims."

== Total Amount Lost ==
"From 0x4fcFdda0...a7227d75c To Fake_Phishing324039 For 1,681.63256625 $24,366.86 ChainLink To... (LINK)"

"From 0x4fcFdda0...a7227d75c To 0x82AE0340...31c67C636 For 7,927.69638375 $114,872.32 ChainLink To... (LINK)"

The total amount lost has been estimated at $137,000 USD.

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="chainaegistwitter-14527">[https://twitter.com/ChainAegis/status/1807699446010097750 @ChainAegis Twitter] (Accessed Jul 2, 2024)</ref>

<ref name="chainaegisapp-14528">[https://app.chainaegis.com/result?type=eth&search=0x4a668c050d1228f9c5e35e7310a26a6f5d2cd5c7bfe7e44338d2c0d9a202cfc8 ChainAegis] (Accessed Jul 2, 2024)</ref>

<ref name="etherscan-14529">[https://etherscan.io/tx/0x4a668c050d1228f9c5e35e7310a26a6f5d2cd5c7bfe7e44338d2c0d9a202cfc8 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Accessed Jul 2, 2024)</ref>

<ref name="bitraceteamtwitter-14530">[https://twitter.com/Bitrace_team/status/1808161495106347377 @Bitrace_team Twitter] (Accessed Jul 2, 2024)</ref>

<ref name="groupibmedium-14531">[https://group-ib.medium.com/goodbye-inferno-drainer-f0f009d44adc Goodbye Inferno Drainer? How the scam service stole millions of dollars and why it’s still dangerous | by Group-IB | Medium] (Accessed Jul 2, 2024)</ref>

<ref name="therecord-14532">[https://therecord.media/inferno-drainer-cryptocurrency-scam-spoofing-blockchain-projects How a ‘crypto drainer’ tricked people into handing over $80 million in assets worldwide] (Accessed Jul 2, 2024)</ref>

<ref name="infernodrainertelegram-14533">[https://t.me/InfernoDrainer/150 Telegram: Contact @InfernoDrainer] (Accessed Jul 2, 2024)</ref>

<ref name="cointelegraph-14534">[https://cointelegraph.com/news/inferno-drainer-shut-down-after-stealing-millions-crypto-wallet-scam-kit https://cointelegraph.com/news/inferno-drainer-shut-down-after-stealing-millions-crypto-wallet-scam-kit] (Accessed Jul 2, 2024)</ref>

<ref name="infernodrainerarchive-14535">[https://web.archive.org/web/20230619050207/https://inferno-drainer.com/ https://web.archive.org/web/20230619050207/https://inferno-drainer.com/] (Accessed Jul 2, 2024)</ref>

<ref name="dfgdfgqgarchive-14536">[https://web.archive.org/web/20231130172945/https://dfgdfgqg.com/login Login | Inferno Drainer] (Accessed Jul 2, 2024)</ref>

<ref name="infernodrainerarchive-14537">[https://web.archive.org/web/20230621221153/http://inferno-drainer.com/login/ Login | Inferno Drainer] (Accessed Jul 2, 2024)</ref>

<ref name="groupib-14538">[https://www.group-ib.com/blog/inferno-drainer/ https://www.group-ib.com/blog/inferno-drainer/] (Accessed Jul 2, 2024)</ref>

<ref name="cryptoslate-14539">[https://cryptoslate.com/crypto-phishing-kit-inferno-drainer-shuts-down-after-enabling-over-80m-in-scams/ Crypto phishing kit Inferno Drainer shuts down after enabling over $80M in scams] (Accessed Jul 2, 2024)</ref>

<ref name="nftnewstoday-14540">[https://nftnewstoday.com/2023/05/23/inferno-drainer-the-6-million-web-of-deception/ Inferno Drainer: The $6 Million Web of Deception - NFT News Today] (Accessed Jul 2, 2024)</ref>

<ref name="cryptoslate-14541">[https://cryptoslate.com/inferno-drainer-resumes-operations-claims-250-million-stolen-from-crypto-users/ Inferno Drainer resumes operations, claims $250 million stolen from crypto users] (Accessed Jul 2, 2024)</ref>

<ref name="plumfernotwitter-14542">[https://twitter.com/Plumferno/status/1792678811575738717 @Plumferno Twitter] (Accessed Jul 2, 2024)</ref>

<ref name="decrypt-14543">[https://decrypt.co/140877/inferno-drainer-scam-scammer-phishing-crypto-nfts What Is Inferno Drainer? New Phishing Scam Pilfering Crypto, NFTs - Decrypt] (Accessed Jul 2, 2024)</ref>

<ref name="coinmonksmedium-14544">[https://medium.com/coinmonks/pink-drainer-out-inferno-drainer-back-new-shift-in-the-crypto-wallet-drainer-industry-6915c270bb68 Pink Drainer Out Inferno Drainer Back New Shift In The Crypto Wallet Drainer Industry] (Accessed Jul 2, 2024)</ref>

<ref name="dune-14545">[https://dune.com/scamsniffer/inferno-drainer https://dune.com/scamsniffer/inferno-drainer] (Accessed Jul 2, 2024)</ref></references>