前沿资讯：加密货币正面临日益严重的威胁
Overview of Crypto Drainers
加密流水机的概述
As the cryptocurrency market continues to evolve, so do the tactics employed by malicious actors to steal user funds. The latest threat, crypto drainers, has been gaining prevalence in recent years. In contrast to more conventional methods such as private key theft and smart contract exploitation, drainers pose as web3 projects to trick victims into granting them control of their crypto wallets. These scams have affected a wide range of users, with even high-profile figures like Mark Cuban and Seth Green falling prey. The amounts stolen can be staggering, with some drainers reportedly siphoning off several million dollars from their victims. Recently, Chainalysis shared insights into details of Crypto Drainers.
随着加密货币市场的不断发展，恶意行为者窃取用户资金的手段也在不断翻新。近年来，加密货币泄密者这一最新威胁日益猖獗。与窃取私钥和利用智能合约等更传统的方法不同，流失者会伪装成 web3 项目，诱骗受害者授予他们加密货币钱包的控制权。这些骗局影响了众多用户，甚至连马克-库班（Mark Cuban）和塞斯-格林（Seth Green）等知名人士也上当受骗。盗取的金额可能非常惊人，据说有些盗取者从受害者那里盗取了几百万美元。最近，Chainalysis 分享了对加密货币放水者细节的洞察。
Understanding How Crypto Drainers Operate
了解加密流水机的运作方式
A crypto drainer is essentially a phishing tool designed for the web3 ecosystem. Instead of stealing usernames and passwords, the operators of these scams masquerade as legitimate web3 projects. They lure victims into connecting their crypto wallets to the drainer and approving transaction proposals, which effectively grant the scammers control of the funds in the victims' wallets. Following a successful attack, the drainers can instantly steal users' funds. The fraudulent web3 sites are often promoted in Discord communities and on compromised social media accounts.
加密流水机本质上是为Web3生态系统设计的网络钓鱼工具。这些骗局的操作员没有窃取用户名和密码，而是将用户名为合法的Web3项目。他们诱使受害者将其加密钱包与排水店联系起来，并批准交易提案，这有效地使骗子控制了受害者钱包中的资金。成功攻击后，排水渠可以立即窃取用户的资金。欺诈性的Web3网站通常在不和谐社区和受损的社交媒体帐户中促进。
The Impact of Crypto Drainers on the Crypto Ecosystem
加密流失者对加密生态系统的影响
While it is challenging to ascertain the total amount stolen by crypto drainers due to underreporting, the available data suggests that the scale of these scams is significant. In fact, the quarterly growth rate in value stolen by drainers has outpaced that of ransomware, another fast-growing category of cybercrime. After stealing digital assets, the criminals typically rely on various crypto services to launder the funds or convert them into cash. There has been a noticeable increase in funds sent by drainers to mixing services since 2021, while the funds sent to centralized exchanges have decreased. Some drainers are also using gambling services, albeit on a smaller scale.
尽管由于报道不足，因此确定加密货币排水池偷走的总量是一个挑战，但可用的数据表明，这些骗局的规模很大。实际上，排水量偷走的价值增长率已经超过了勒索软件的勒索软件，这是另一个快速增长的网络犯罪类别。窃取数字资产后，犯罪分子通常依靠各种加密服务来洗钱或将其转换为现金。自2021年以来，排水渠向混合服务发送的资金显着增加，而发送给集中式交易所的资金减少了。一些排水器还使用赌博服务，尽管规模较小。
Bitcoin's Encounter with Crypto Drainers
比特币与加密流水机的相遇
While most drainers currently operate within the Ethereum ecosystem, an unusual drainer exploiting the Bitcoin blockchain has been identified. This drainer created a fake web page posing as Magic Eden, the primary NFT platform for Bitcoin Ordinals. As of April 2024, this drainer has allegedly stolen approximately $500,000 in over 1,000 malicious transactions. Despite Bitcoin not being as widely used for web3 services as other assets, several other Bitcoin drainers have already targeted the Ordinals trading community.
尽管大多数排水器目前都在以太坊生态系统中运行，但已经确定了利用比特币区块链的异常排水器。该排水器创建了一个假装的伪造网页，该页面是Magic Eden，这是比特币序列的主要NFT平台。截至2024年4月，据称该排水店已偷走了1,000多笔恶意交易中约500,000美元。尽管比特币没有像其他资产那样广泛用于Web3服务，但其他几个比特币排水器已经针对了序列交易界。
Preventing Crypto Drainer Attacks
防止加密流失攻击
As the operators of crypto drainers become increasingly sophisticated, it is crucial for web3 projects and users to implement various security measures to guard against these scams. Web3 security extensions such as Wallet Guard can identify phishing pages and websites, and assess security risks associated with cryptocurrency wallets. Users can also reduce their exposure to drainers by using an offline wallet to store valuable or large volumes of assets, only transferring funds to a hot wallet when necessary. In addition, they should be wary of links promoted in chat rooms or on social media, which may not be associated with a project's official account. If a user needs to connect to an unfamiliar web3 site, they can create a temporary wallet that doesn't contain any assets and connect it to the site. If a victim's assets are stolen by a drainer, they can cancel incomplete transactions.
随着加密流水机的运营商变得越来越复杂，对于Web3项目和用户来说，执行各种安全措施以防止这些骗局至关重要。Web3安全性扩展名（例如钱包卫队）可以识别网络钓鱼页面和网站，并评估与加密货币钱包相关的安全风险。用户还可以通过使用离线钱包存储有价值或大量资产，仅在必要时将资金转移到热钱包时，可以减少其对排水沟的接触。此外，他们应该警惕在聊天室或社交媒体上促进的链接，这可能与项目的官方帐户无关。如果用户需要连接到不熟悉的Web3网站，则可以创建一个不包含任何资产并将其连接到该站点的临时钱包。如果受害者的资产被排水库偷走，他们可能会取消不完整的交易。
