What happened
On December 28, 2023, the Pink Drainer phishing group stole about 275,700 LINK from a single Ethereum holder. At the time the tokens were valued at roughly $4.2-4.4 million. The victim had approved an increased LINK allowance for an attacker-controlled spender.
Scam Sniffer linked the theft to Pink Drainer, but it is not known exactly how the attackers got the victim to consent to the approval. The drainer wallet then called transferFrom twice in the same block. It sent 206,775 LINK to 0x8FaE6d798Ec0A2127f962CE49573492894D2E70e and 68,925 LINK to 0x9fA7bB759641FCd37fe4aE41f725e0f653f2C726 (labelled PinkDrainer: Wallet 2).
ZachXBT reported that the LINK was quickly converted to ETH and laundered through the eXch service. No recovery has been reported.
How it happened
- The victim (
0xEa69653e6DD19789ac15ce5752547a94DA8dd4cf) approved an allowance increase on the LINK token, giving a drainer-controlled address the right to spend their LINK. How the attackers obtained that approval has not been established. - At 21:41:23 UTC on December 28, 2023,
PinkDrainer: Wallet 1(0x63605E53D422C4F1ac0e01390AC59aAf84C44A51) calledtransferFromon the LINK contract twice. The transactions were0x70026eae27a76205cfb2271108e201570cb03b7daa7e8395280f9acdfbd82a05and0x15bc5516ed7490041904f1a4c594c33740060e0f0271cb89fe9ed43c974a7a69. - 206,775 LINK went to a phishing-labelled address and 68,925 LINK went to
PinkDrainer: Wallet 2. - The LINK was swapped to ETH and moved through eXch.
Protocol details
Evidence
- report @realScamSniffer incident report twitter.com
- transaction Etherscan transaction 0x70026eae...2a05 etherscan.io
- transaction Etherscan transaction 0x15bc5516...7a69 etherscan.io
- address etherscan.io address 0x8FaE…E70e etherscan.io
- address etherscan.io address 0x9fA7…C726 etherscan.io
- address etherscan.io address 0xea69…d4cf etherscan.io
- analysis Pink Drainer hackers stole $4.4m in Link crypto.news
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
