DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs

DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs

Speakers: Hanna Kim

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=D-RftRnIPVk

Overview

This article delves into DRAINCLoG, a groundbreaking research initiative presented at the NDSS Symposium, focused on combating the escalating threat of NFT drainers within the Non-Fungible Token (NFT) ecosystem. The talk, delivered by Hanna Kim, highlights a critical vulnerability in the rapidly expanding NFT market where sophisticated scammers leverage phishing tactics to steal valuable digital assets. With over $100 million worth of NFTs reported stolen in the past year alone, and high-profile incidents like the Uniswap NFT holders attack resulting in an estimated $8 million in damages, the urgency for robust detection mechanisms is paramount.

DRAINCLoG addresses the fundamental limitations of existing cryptocurrency phishing detection methods, which are ill-suited for the unique characteristics of NFTs. Unlike fungible cryptocurrencies, NFTs possess distinct identities and dynamic values, leading to far more intricate transaction patterns involving multiple types of transfers and individual asset histories. The research introduces the first comprehensive empirical study into the trading behaviors of NFT drainers and proposes DRAINCLoG as the first dedicated, automatic detection system based on Graph Neural Networks (GNNs). The system is designed to capture the multifaceted relationships and unique characteristics within the NFT space, offering a robust defense against evolving evasion tactics.

Background

▶ Watch: Introduction: The growing threat of NFT drainers (0:00)

Non-Fungible Tokens (NFTs) are unique cryptographic assets stored on a blockchain, primarily the Ethereum blockchain, representing ownership of digital items. Their uniqueness and verifiable scarcity have led to a booming market, but also attracted malicious actors. The research categorizes NFT transactions into four primary types:

• Mint: The creation of a new NFT.
• Sale: Transfer of NFT ownership for monetary payment, typically in Ether or other fungible tokens.
• Gift: Transfer of ownership without monetary exchange, often used between related addresses, for market manipulation like wash trading, or in the context of illicit activities.
• Burn: Removal of an NFT from circulation.

The core objective of NFT drainers is to steal NFTs from victims, predominantly through phishing scams. This process typically unfolds in three stages:

1. Spreading phishing websites: Drainers impersonate official entities on social media or leverage phishing token airdrops to lure victims to malicious sites.
2. Draining NFTs from victims: This occurs either by capturing crypto wallet login credentials or, more commonly, by exploiting smart contract functions like setApprovalForAll. A victim signing a malicious transaction grants the drainer permission to transfer all their tokens. On the blockchain, these unauthorized transfers are recorded as 'gifts'.
3. Cashing out drained NFTs: Unlike fungible cryptocurrencies that can be mixed to obscure origins, stolen NFTs are typically sold on marketplaces. While platforms like OpenSea have policies to disable trading of reported stolen items, drainers constantly seek bypasses.

Existing efforts to combat this threat, such as OpenSea's marking of stolen NFTs or MetaMask's phishing warnings, have proven limited or bypassable. Previous research into cryptocurrency phishing detection, which often relies on handcrafted features or GNN models like Node2Vec, E-GCN, and GAT, is largely inapplicable to NFTs. This is due to several key differences: NFT features, such as liquidation processes, differ significantly from cryptocurrencies; the unique identity and dynamic value of individual NFTs are not adequately considered; and existing methods fail to capture the complex social relationships among NFT users, which are critical given the multiple transaction types. DRAINCLoG was developed to specifically address these challenges.

To facilitate this research, an extensive dataset was constructed. Over 127 million NFT transaction records from the Ethereum blockchain were collected, spanning January to December 2022, covering 80 million NFTs and over 4 million unique accounts. Transactions were classified as sales or gifts by analyzing transfer logs and associated external transactions for payments. Additionally, 1,230 reported drainer accounts were crawled from five sources (Twitter, ScamSniffer, Etherscan, CryptoScamDB, Chainabuse) up to January 1, 2023. An account was defined as a drainer if it had at least one gifted-in NFT, leading to the identification of 1,135 unique drainer accounts. This comprehensive dataset serves as the foundation for DRAINCLoG's empirical study and model training.

Key Findings

▶ Watch: Understanding the three-step NFT drainer attack process (2:59)

The empirical study conducted on 645 drainer accounts (January-July 2022) compared against 6,658 randomly sampled regular users revealed several distinct behavioral characteristics of NFT drainers, which informed the design of DRAINCLoG:

• Active Timespan: Drainers exhibit a significantly shorter active timespan compared to regular users. This suggests that drainer accounts are typically short-lived and created specifically for malicious activities.
• Gift-in Ratio: A high proportion of drainers, specifically 75.1%, obtain NFTs exclusively through gifting-in. This aligns directly with the mechanism of stealing NFTs, where unauthorized transfers are recorded as gifts on the blockchain.
• Out-in Ratio: Drainers have a higher out-in ratio, with 75.9% making out-transactions for more than half of their NFTs. This indicates a strong intent to quickly liquidate stolen assets rather than holding them for long periods.
• Affiliated Accounts for Liquidation: A notable 82.5% of drainers utilize one or more affiliated users to indirectly liquidate stolen NFTs. The study identified 637 unique affiliated users, with 15.4% connected to multiple drainers, pointing to a collaborative network. While 60% of these affiliated users primarily receive gifted-in NFTs, 40% also engage in buying and minting, mimicking regular user behavior to obfuscate their activities.
• Rapid Liquidation: Drainers sell over 80% of their stolen NFTs within a single day, a rate twice as fast as regular users. They also gift NFTs out much faster. Analysis showed that 90% of drainer holding times are shorter than the average regular user holding time, with an average decrease of 87.7%. This rapid movement suggests two primary liquidation strategies: direct quick selling or quick gifting to affiliated users for subsequent sale.
• Bargain Prices: Drainers sell a significant majority (74% to 76%) of their NFTs at prices considerably lower than market value, with an average price decrease of 37% to 39%. This rapid, discounted selling is a strong indicator of illicit activity, prioritizing speed of liquidation over maximizing profit.

These distinct transactional and social contexts form the empirical basis for DRAINCLoG's advanced detection capabilities, allowing the system to differentiate malicious behavior from legitimate trading patterns.

Technical Deep Dive

▶ Watch: Key findings: Distinct characteristics of NFT drainer behavior (6:09)

DRAINCLoG's architecture is meticulously designed to address the complexity of NFT transactions and user relationships by leveraging Graph Neural Networks (GNNs). The system integrates information from two distinct graph structures and user node attributes to create a comprehensive user representation.

The process begins with Feature Engineering, extracting two primary types of features:

1. NFT ownership edge attributes (7 features): These describe how users interact with specific NFTs within the NFT-User graph. Key features include:

• Holding time: The duration an NFT is owned by a user, typically shorter for drainers.
• In-transaction type & Out-transaction type: Categorical features indicating how an NFT was acquired (buy/gift-in) and how it was disposed of (sell/gift-out/hold). Drained NFTs are predominantly 'gifted-in'.
• In-price & Out-price: The price in Ether for which the NFT was bought or sold. Drainers typically sell at lower prices.
• Average holding time & Average sale price: NFT-level averages used as a reference to detect anomalies in individual transactions.

1. User node attributes (19-dimensional features): These capture detailed trading behaviors for the User graph. Critical attributes include:

• Active timespan: Shorter for drainer accounts.
• Gift-in ratio: Proportion of gift-in transactions to all in-transactions, high for drainers.
• Out-in ratio: Proportion of out-transactions to in-transactions, higher for drainers.
• Number of each transaction type: Minting, buying, gifting-in, selling, gifting-out. Drainers show a focus on selling and gifting-in.
• Number of collections for each transaction type: Drainers often trade more diverse collections due to stealing from various sources.
• Number of neighbors for each transaction type: Drainers may have more neighbors from gift-in transactions.
• Frequency of gift-ins & sales: Drainers exhibit higher frequencies of these specific transaction types.

DRAINCLoG then employs two specialized extractors:

• NFT Transaction Context Extractor (TCE): This operates on an undirected NFT-User graph, G(U, N, ET), comprising user nodes (U), NFT nodes (N), and attributed edges (ET) representing NFT ownership. The TCE first derives a transaction context (hN) for each NFT node (n) by aggregating its transaction history using a convolution layer with mean-pooling. Subsequently, for each user (u), a representation (hun) for each neighboring NFT (n) is created by concatenating the user's ownership details (tun) with the NFT's context (hN). To generate the user's final NFT transaction context, all hun vectors are integrated using a multi-head graph attention mechanism, which helps reduce noise and capture irregular patterns. This representation is then used for initial classification training with cross-entropy loss.

• Social Context Extractor (SCE): This module models user-to-user interactions on a User graph, G(U, E, R, XU), where U are user nodes, E are labeled edges (ui, r, uj) representing transaction types (sale, gift), and XU are the 19-dimensional user node attributes. The SCE utilizes the R-GCN (Relational Graph Convolutional Network) model to effectively capture relational dependencies and derive meaningful representations of users' social contexts. R-GCN propagates information across layers, aggregating features from neighboring user nodes based on the specific relation types (e.g., sale, gift). This module is also trained with cross-entropy loss.

Finally, the Drainer Classifier combines the rich information from these two extractors with the initial user node attributes. The NFT transaction context representation from TCE, the social context representation from SCE, and the raw user node attributes are concatenated to form a comprehensive representation for each user. This combined feature vector is then fed into a Support Vector Machine (SVM) classifier. SVM was chosen for its advantages in reducing overfitting and ensuring stability, particularly when handling high-dimensional feature spaces, thereby enabling DRAINCLoG to accurately identify drainer accounts by integrating both transactional and social contexts.

Demo / Proof of Concept

▶ Watch: Specific behavioral patterns: active timespan, gift-in, out-in ratios (6:40)

While the talk did not feature a live demonstration of DRAINCLoG in action, the research included a rigorous experimental setup and evaluation of the system's performance, robustness, and effectiveness. The evaluation served as a proof of concept for DRAINCLoG's ability to detect NFT drainers in real-world scenarios.

The training dataset was constructed from accounts active between January 1 and July 31, 2022, comprising 3,137,221 accounts, including 645 identified drainers. To address the severe class imbalance, a sampling strategy was employed, resulting in a final training dataset of 645 drainers and 51,600 regular users (a 1:80 ratio). The evaluation dataset was derived from accounts active from August 1 to December 31, 2022, containing 1,723,465 accounts, with 490 identified drainers. Three evaluation datasets (D1, D2, D3) were created with varying drainer-to-regular-user ratios (1:10, 1:100, and 1:1000) to thoroughly assess performance under different class imbalances.

DRAINCLoG consistently outperformed all baseline methods, including feature-based (Ether features 18, E-GCN features 17, DRAINCLoG user features) and graph-based approaches (Trans2Vec 58, E-GCN 17, GAT 55, GraphSAGE 27). For instance, on the D3 dataset (1:1000 ratio), DRAINCLoG achieved a Precision of 0.448, Recall of 0.628, and an F1-score of 0.523, significantly surpassing the best graph-based baseline (N-GraphSAGE's 0.416 Precision, 0.579 Recall, and 0.484 F1-score).

An ablation study further validated the importance of DRAINCLoG's components:

• Removing the NFT transaction context (from TCE) led to a marked drop in recall, emphasizing its role in identifying subtle drainer activity.
• Removing the social context (from SCE) resulted in the lowest precision, highlighting its crucial role in preventing false positives.
• Excluding relational information in the SCE (using GCN instead of R-GCN) impaired performance, especially with more regular users, underscoring the importance of transaction types for drainer identification.

The research also rigorously tested DRAINCLoG's robustness against evasion attacks, where drainers attempt to alter their trading patterns. Four attack types were modeled: minting innocuous NFTs, increasing active timespan, sending Ether to victims to mimic a sale, and a combination of these tactics. Attacks directly modifying user and NFT relationships (e.g., Attack 3 and 4) posed the greatest challenge, with F1-scores dropping significantly (e.g., from 0.523 to 0.314 for Attack 4 on D3). However, a proactive defense mechanism involving periodic re-training of the SVM classifier with a small percentage (3%) of newly identified evasion attackers dramatically improved performance, restoring F1-scores (e.g., from 0.314 to 0.523 for Attack 4 on D3). This demonstrates DRAINCLoG's adaptability and ability to detect evolving threats.

Defensive Implications

▶ Watch: Introduction to DRAINCLOG's system design and architecture (9:00)

The insights and capabilities offered by DRAINCLoG have significant implications for strengthening the security posture of the NFT ecosystem. The system's ability to identify drainer accounts and assign risk scores in near real-time can be integrated into various security frameworks:

• Integration with crypto wallets: Wallet providers can integrate DRAINCLoG to cross-reference recipient accounts against its drainer list when a user attempts a transaction. If a match is found, the transaction can be halted, and the user can be issued a warning, preventing potential victimization before funds or NFTs are lost. For accounts with high-risk scores, warnings can be triggered proactively, enhancing user protection.
• Integration with NFT marketplaces: Marketplace administrators can receive real-time updates on identified drainer accounts and associated user risk scores. This enables automated banning mechanisms for accounts exceeding a high-risk threshold, or manual inspection for less stringent thresholds. Timely identification and banning disrupt drainers' revenue streams and prevent the liquidation of stolen assets.
• Proactive Threat Adaptation: DRAINCLoG's proactive defense mechanism, which involves periodically re-training the SVM classifier with a small percentage (3%) of newly identified evasion attackers, is crucial for maintaining effectiveness against evolving drainer strategies. This adaptive learning allows the system to capture new, hidden complex relationships within the graphs that attackers might employ.
• Enhanced Reporting and Collaboration: Newly identified drainer accounts can be incorporated into DRAINCLoG's database, augmenting its ability to identify future threats. Furthermore, integration with victim reports and phishing website detection systems can enrich the dataset, providing a more comprehensive view of the threat landscape.
• Future Enhancements: While DRAINCLoG is robust, future work could integrate it with wash trading detection systems to identify more sophisticated cyclic trading patterns used by attackers to mask liquidation. Additionally, factoring in the synchronous influx of multiple NFTs from victims (a common drainer tactic) into edge attributes, along with blockchain timestamps, could further refine detection and distinguish evasive attackers. Addressing false positives by better distinguishing legitimate users managing multiple wallets, and improving detection of false negatives (drainers with atypical liquidation patterns), will further enhance the system's accuracy and practical utility for defenders.

DRAINCLoG's capacity to detect high-profile incidents, such as the December 2022 North Korean incident (1,055 NFTs stolen via 15 affiliated accounts) and the October 2022 Monkey Drainer incident ($3.5 million/251 NFTs stolen over four days), underscores its real-world applicability and potential to significantly contribute to improving NFT trading security.

Key Takeaways

• NFT drainers pose a significant and growing threat, having stolen over $100 million in NFTs, leveraging sophisticated phishing scams that bypass existing security measures.
• Traditional cryptocurrency phishing detection methods are inadequate for NFTs due to their unique identities, dynamic values, and complex transaction types.
• DRAINCLoG introduces the first comprehensive empirical study on NFT drainer behavior, revealing distinct patterns like shorter active timespans, high gift-in ratios, rapid liquidation (over 80% sold within a day), use of affiliated accounts, and selling at significant bargain prices (37-39% below market value).
• DRAINCLoG is a novel GNN-based detection system that effectively captures complex relationships using two distinct graph structures: an NFT-User graph for transaction contexts and a User graph for social contexts, combined with tailored feature engineering.
• Evaluations demonstrate DRAINCLoG's superior effectiveness and robustness against various evasion attacks, with a proactive defense mechanism allowing it to adapt to evolving drainer strategies.
• The system can be integrated into crypto wallets and NFT marketplaces to provide real-time warnings, automated banning, and disrupt drainers' revenue streams, significantly enhancing NFT trading security.

About the Speaker(s)

Hanna Kim is the speaker who presented the research on DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs at the NDSS Symposium. The transcript and metadata provided do not include further details about her title or company affiliation.