Pink Drainer

Overview

Pink Drainer was a prominent "drainer-as-a-service" operation that supplied wallet-draining phishing tools to affiliates. It became known for impersonation and account-takeover campaigns: compromising verified X (Twitter) and Discord accounts — including those of projects, journalists, and security firms — to post phishing links that tricked followers into signing malicious transactions or approvals. ^[1][2]

Notable activity

Pink Drainer was tied to high-profile social-account hijacks during 2023–2024. Security firm SlowMist tracked its fund flows, noting a portion of proceeds was parked in yield-bearing assets (e.g. MakerDAO's sDAI). As with other DaaS crews, the take was split automatically in code between the affiliate and the drainer's developers. ^[1][2]

Scale and exit

Investigator ZachXBT reported Pink Drainer announced a "retirement" in 2024; Scam Sniffer data indicated it had been used to steal more than $75 million — later estimates exceeded $85 million — from roughly 20,000 victims in about a year. Its exit, like Monkey Drainer's before it, simply shifted affiliates toward rival drainers. ^[1][2]

Bracketed numbers refer to the numbered sources listed below.