Pink Drainer Phishing Campaign
What happened
Scam Sniffer's June 9, 2023 report linked Pink Drainer to about $3 million stolen from roughly 1,932 victims across multiple chains. This page describes that May-to-June campaign snapshot, not one protocol losing the entire amount on June 3. Later lifetime totals should not be substituted for this dated estimate.
Compromised social accounts gave phishing links apparent legitimacy. Victims then authorized malicious wallet actions; the campaign did not depend on one shared protocol-contract vulnerability.
How it happened
Scam Sniffer documented social engineering aimed at Discord administrators, including fake media interviews and malicious verification steps that stole session tokens. Hijacked accounts distributed links to pages designed to solicit malicious wallet signatures.
The report associated incidents involving several communities and accounts, including Orbiter Finance and OpenAI's CTO. Association with a phishing campaign does not mean their underlying protocol contracts were exploited.
For community operators, securing administrator sessions and rapidly removing fraudulent messages addresses the distribution channel. Wallet users still need to verify the actual spender and requested action rather than trust the account that posted a link.
Protocol details
Post-Incident Timeline
-
2023-07-19
On July 19, 2023, another phishing incident in Arbitrum chain was reported, from where the relation to PinkDrainer was discovered. 613,627 $USD was stolen in $MAGIC tokens and then transferred to $ETH. Consequently, the funds were bridged to Ethereum. Attacker Address: Address 0xcb72…bcd5 Malicious Transaction: Tx 1 0x9072…d65f Relation proof: Tx 2 0xb73b…9006
-
2023-08-30
Another victim lost 200,921 USD worth of UNIBOT tokens via ERC20 Permit Phishing. The wallet marked as PinkDrainer1 initiated a malicious transaction and transferred 390.26 and 910.61 UNIBOT tokens to two addresses respectively. Malicious Transaction: Tx 0x3584…3db2 Scammer Addresses: Address 0x6360…4a51 Funds Transferred To: Address 0x9fa7…c726 Address 0x6e02…1932
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
