$1.25 million stolen in NFT Airdrop Phishing Scam linked to Inferno Drainer

Overview

Scam Sniffer has received multiple reports of theft related to NFT airdrops on Polygon. Victims received airdropped NFTs and believed in their contents, but ended up having their assets stolen after opening malicious links and signing malicious signatures during the claiming process.

The group responsible for these thefts has created 1,354 malicious NFTs on Polygon in recent months, impersonating legitimate airdrops from projects like RocketPool, ApeCoin, Polygon, Uniswap, and AAve. All malicious links in these airdrops lead to websites associated with Inferno Drainer, One of the “Scam As a Service” providers that steals $13M in the last few months.

A total of 530,000 wallets were targeted by these malicious NFTs, and 329 victims were associated with the targeted airdrops. In total, $1.25 million was stolen from these victims.

Dune Report: https://dune.com/scamsniffer/nft-phishing-polygon

Malicious NFT airdrops

Attackers transferred ApeCoin Airdrop malicious NFTs to their targets through batchtransfer.

The target opened their Portfolio Tracker or wallet and found and clicked on the malicious NFT.

As shown in the figure, they used beacons.ai for dynamic link redirection. The victim clicked on the malicious link in the description and signed the malicious signature in the malicious website, resulting in asset theft.

Large-scale malicious NFT airdrops

By analyzing the addresses associated with the airdropped NFTs received by the victims, we found many NFTs with similar patterns, including those that impersonated the airdrops of projects such as Rocketpool, Apecoin, Arbitrum, Uniswap, Ethereum, AAVE, ChainLink, etc.

Through analyzing on-chain data, we found that they created 1,354 malicious NFTs, targeted at 530,000 wallets, and a total of 1.25 million airdrops were made.

All of these malicious links lead to malicious websites associated with Infeno Drainer.

Targeted victims

We sampled some of the targeted airdrop addresses, most of which contained large amounts of assets.

Stolen Stats

By analyzing the 530,000 addresses targeted by these malicious NFTs and the victims of Infeno Drainer, we found that 329 victims were associated with the targeted airdrops, and a total of $1.25 million was stolen from these victims.

The largest victim, 0x9e1b8f42c28c793f67d44968529e338606ba7e66, lost about $150k.

Dune Report: https://dune.com/scamsniffer/nft-phishing-polygon

Victims

0x9e1b8f42c28c793f67d44968529e338606ba7e66, the largest victim, was recently phished for 79ETH through a Claim scam.

The victim received a malicious NFT from the ApeCoin Airdrop 24 days ago.

Gas Spend

By analyzing on-chain data, we found that the total gas cost for airdropping to these 500k addresses was only $15k, which was very low.

Excluding the 20-30% commission charged by using Inferno Drainer, we can estimate that they spent $15k to steal $875k in assets.

Among these targeted 500k addresses, new victims will continue to emerge in the future.

About Scam Sniffer

Scam Sniffer is an anti-scam platform that combined off-chain and on-chain monitoring data to provide real-time anti-scam protection for web3 users.

We’ve helped well-known platforms protect their users and are committed to making web3 secure for the next billion users.