Airdrop phishing-related crypto scams have been on the rise of late, with sophisticated wallet draining software targeting Solana users over the last month.

According to analysis from blockchain security firm Scam Sniffer, two main Solana wallet drainers have stolen $4.17 million worth of crypto from 3,947 victims. 

Rainbow Drainer and Node Drainer are the two malicious software kits, which seem to have first appeared around the second week of December 2023.

“Scammers employ anti-simulation techniques to prevent wallets from showing balance changes. Victims unknowingly lose their assets by signing malicious transactions,” noted Scam Sniffer. 

By their estimates, Rainbow Drainer has stolen $2.1 million from 2,189 users, most of whom fell victims to airdrop phishing campaigns. Holders of the ZERO token were targeted with phishing NFTs that were sent to them in an airdrop. Since the details of the transaction were hidden, users who signed these had their wallets drained of assets.

Meanwhile, Node Drainer scams largely targeted holders of the memecoin BONK and also appeared in a phishing link from the hack of Mandiant’s X account. Mandiant, a Google-owned cybersecurity firm, said that “some team transitions and a change in X’s 2FA policy” resulted in the security breach.

One particular address that used Node Drainer made over $1 million in profit after converting stolen ETH into USDC through the cross-chain solution Allbridge. 

“Unlike most thefts on Ethereum, which are due to malicious approval issues, the majority of phishing signatures on Solana involve initiating direct transfers,” Scam Sniffer explained. 

In 2023, crypto wallet drainers stole an estimated $295 million from around 324,000 victims, with Inferno Drainer, MS Drainer and Angel Drainer accounting for a collective $160 million stolen in March alone.