Amid a rash of crypto scams that have pilfered millions of dollars’ worth of Ethereum NFTs from unsuspecting users’ wallets, the unknown pseudonymous
entity referred to as “Monkey Drainer” has claimed a fresh cache of valuable CryptoPunks and Otherside NFTs.

Self-described “on-chain sleuth” ZachXBT—a pseudonymous Twitter user with a history of publishing data on crypto scams and controversial figures—shared
Thursday evening that Monkey Drainer had stolen 520 ETH worth of NFTs from those two valuable Yuga Labs collections, which works out to roughly $800,000.

Some of the NFTs were funneled between multiple wallets and ultimately sold. Based on public blockchain data visible through Etherscan, the attacker
then funneled 400 ETH through Tornado Cash, a crypto privacy tool for Ethereum that was sanctioned by the U.S. government in August and cannot legally
be used by citizens.

Monkey Drainer just stole another 7 Crypto Punks and 20 Otherside NFTs worth $800k (520 ETH)

ZachXBT previously estimated that Monkey Drainer had stolen well over $3.5 million worth of crypto and NFTs. Monkey Drainer was also used for an exploit
perpetrated through the hijacked Twitter account of Gabriel Leydon, CEO of Web3 gaming startup Limit Break, on Wednesday.

Web3 security firm Wallet Guard similarly believes Monkey Drainer is a type of malware-as-service, meaning the creator of the “drainer” smart
contract—that is, the code that powers NFTs and decentralized applications—is selling their phishing toolkit to others.

“Monkey sells his drainer for 30% cut of an attack,” ZachXBT tweeted. “So other scammers are coming to him with these accounts.”

Monkey sells his drainer for 30% cut of an attack. So other scammers are coming to him with these accounts

“The attacks are somewhat unsophisticated, and with some proper cyber hygiene, NFT holders can easily protect themselves,” Schwed told Decrypt via
email. “For the scam to work, the NFT holders have to grant the malicious actor access to effectuate a transaction.”

The NFT space has seen a surge in these scams over the course of 2022. Many are shared through hacked social media accounts, which point to what
collectors believe is a legitimate NFT mint or airdrop

claim. Instead, they unwittingly give full access to their wallet holdings to the attacker, and typically have their NFTs and crypto swiped before they
realize it.

Monkey Drainer may be running amok across the Ethereum network for now, but at least one ethical hacker is trying to slow its reign of chaos.

He attacked their API keys!
So one of Monkey's attack moves is

1) Trick you into signing a gasless OS offer that gives him your NFTs for free

2) Broadcast that offer to the ETH blockchain and 'activates' the offer to steal your assets

On Sunday, November 6, 2022 at 10:31:02 AM UTC-5, Sergi o wrote:
> Amid a rash of crypto scams that have pilfered millions of dollars’ worth of Ethereum NFTs from unsuspecting users’ wallets, the unknown pseudonymous
> entity referred to as “Monkey Drainer” has claimed a fresh cache of valuable CryptoPunks and Otherside NFTs.
>
> Self-described “on-chain sleuth” ZachXBT—a pseudonymous Twitter user with a history of publishing data on crypto scams and controversial figures—shared
> Thursday evening that Monkey Drainer had stolen 520 ETH worth of NFTs from those two valuable Yuga Labs collections, which works out to roughly $800,000.
>
> Some of the NFTs were funneled between multiple wallets and ultimately sold. Based on public blockchain data visible through Etherscan, the attacker
> then funneled 400 ETH through Tornado Cash, a crypto privacy tool for Ethereum that was sanctioned by the U.S. government in August and cannot legally
> be used by citizens.
>
> Monkey Drainer just stole another 7 Crypto Punks and 20 Otherside NFTs worth $800k (520 ETH)
>
> ZachXBT previously estimated that Monkey Drainer had stolen well over $3.5 million worth of crypto and NFTs. Monkey Drainer was also used for an exploit
> perpetrated through the hijacked Twitter account of Gabriel Leydon, CEO of Web3 gaming startup Limit Break, on Wednesday.
>
> Web3 security firm Wallet Guard similarly believes Monkey Drainer is a type of malware-as-service, meaning the creator of the “drainer” smart
> contract—that is, the code that powers NFTs and decentralized applications—is selling their phishing toolkit to others.
>
> “Monkey sells his drainer for 30% cut of an attack,” ZachXBT tweeted. “So other scammers are coming to him with these accounts.”
>
> Monkey sells his drainer for 30% cut of an attack. So other scammers are coming to him with these accounts
>
> “The attacks are somewhat unsophisticated, and with some proper cyber hygiene, NFT holders can easily protect themselves,” Schwed told Decrypt via
> email. “For the scam to work, the NFT holders have to grant the malicious actor access to effectuate a transaction.”
>
> The NFT space has seen a surge in these scams over the course of 2022. Many are shared through hacked social media accounts, which point to what
> collectors believe is a legitimate NFT mint or airdrop
>
> claim. Instead, they unwittingly give full access to their wallet holdings to the attacker, and typically have their NFTs and crypto swiped before they
> realize it.
>
> Monkey Drainer may be running amok across the Ethereum network for now, but at least one ethical hacker is trying to slow its reign of chaos.
>
> He attacked their API keys!
> So one of Monkey's attack moves is
>
> 1) Trick you into signing a gasless OS offer that gives him your NFTs for free
>
> 2) Broadcast that offer to the ETH blockchain and 'activates' the offer to steal your assets

And they say crypto currency will take over the dollar.
I can't wait for that!