Security Alert: Drainer Risk Detected on Solana Network by Blowfish

Surge In Solana Drainers

The Solana network faces a significant security threat with the emergence of two new drainers, ‘Aqua’ and ‘Vanish,’ discovered by web3 security firm Blowfish. These malicious tools are sold as scam-as-a-service, prompting heightened security efforts to protect users’ cryptocurrency.

Exploiting Transaction Conditions

These drainers exploit transaction conditions, allowing them to steal users’ cryptocurrency by modifying transaction conditions even after the private keys have approved the transaction. This highlights the growing complexity of cyber threats in the blockchain environment, emphasizing the need for enhanced security mechanisms.

Bit-Flip Attack Method

The drainers work by utilizing the authority granted to decentralized applications (dApps) to submit transactions on behalf of users. Through the modification of a conditional in the transaction data, these drainers can switch from sending to draining SOL from the victimized user’s account. The bit-flip attack method involves modifying the value of bits within encrypted data to influence transaction outcomes, making it a potent weapon for hackers targeting the Solana network.

Scam-as-a-Service Spread

Blowfish’s investigation reveals that Aqua and Vanish scripts are available in scam-as-a-service (SaaS) tool marketplaces, enabling threat actors to use these stealers without deep technical expertise. The commercialization of cybercrime tools has led to a surge in attacks on cryptocurrency users, particularly targeting Solana, which has gained popularity. Chainalysis reports a considerable community formed around a Sellana wallet drainer kit, consisting of over 6,000 people, highlighting the widespread nature of the threat.

Drainer Dangers Prevention Efforts

Blowfish has responded to the detection of Aqua and Vanish by deploying automatic defenses to thwart these drainers. The firm is closely monitoring on-chain activities for suspicious behavior. However, the challenge remains significant as threat actors continually develop new techniques to evade security measures.

International Cybersecurity Angle

The involvement of Russian developers in creating and distributing these drainers, often accompanied by Russian documentation, adds an international dimension to the cybersecurity challenges faced by the Solana community.