Massive Solana Heist: CLINKSINK Drainer Campaigns Target Solana Investors, Swiping Nearly $1M Worth Of SOL

A recent report reveals a significant security breach in the Solana ecosystem, with the CLINKSINK campaign orchestrating a heist of almost $1 million worth of SOL tokens. Mandiant, the cybersecurity firm, has identified this ongoing threat, indicating a growing trend in financially motivated attacks on cryptocurrency users and services.

CLINKSINK Modus Operandi:

The CLINKSINK campaign, active since December 2023, employs drainers – malicious scripts and smart contracts – to steal funds and digital assets, including non-fungible tokens (NFTs), from unsuspecting victims' wallets. Using at least 35 affiliate IDs associated with a drainer-as-a-service (DaaS) utilizing CLINKSINK, the campaign targets Solana investors.

Sample of Phantom airdrop-themed phishing page. Source:Mandiant

Social Engineering Tactics:

The perpetrators distribute cryptocurrency-themed phishing pages through social media platforms and chat applications, posing as reputable resources like Phantom, DappRadar, and BONK. Victims are enticed to interact with the CLINKSINK drainer under the pretense of claiming a token airdrop. Upon connecting their wallets and signing a transaction, the drainer siphons funds from their wallets.

Stolen Funds Allocation:

Mandiant's investigation reveals a systematic division of stolen funds, with 80% going to the affiliate and the remaining 20% to the operator(s) of the drainer service. However, the operator's share can vary between 5% and 25%, influenced by factors like partnerships or reduced fees for successful affiliates.

Estimated Loss and Warning:

Since December 2023, the campaigns have traced at least 1,491 SOL tokens and various underlying tokens, totaling over $180,000, to a specific Solana address associated with the DaaS operator. Mandiant estimates the total losses from these campaigns to be at least $900,000. The report warns of the growing trend of financially motivated threat actors targeting cryptocurrency users and services, emphasizing the availability and low cost of CLINKSINK drainers in underground forums.

olana price rounding the $100 Smilestone. Source:SOLUSDT on TradingView.com

Future Trends and Caution:

With the rising value of Solana's native cryptocurrency, SOL, Mandiant predicts an increase in financially motivated threat actors conducting drainer operations. The ease of access and potential profitability make these campaigns attractive to cybercriminals. Cryptocurrency users and investors are strongly advised to exercise caution, implement robust security measures, and stay vigilant to mitigate the risks posed by the CLINKSINK drainer and similar threats.