SIGBOT// public case libraryAnalyzePricingFund Forensics
Public Data — SIGBOT Analysis
Three historical drainer cases reconstructed from on-chain data. Your case receives the same depth.
Historical reconstruction from public reporting (Group-IB, MetaMask Security, Scam Sniffer, Crystal Intelligence, Dune). Hop rows describe reported flow patterns and link to their sources — individual transaction hashes are not presented as verified here.
CASE FILE tier300 USDC~3-5 business days
◆ Inferno Drainer▲ Venom Drainer■ Pink Drainer
CASE
Inferno Drainer
Tier / Status
CASE FILE · CLOSED
Period
2022-11 → 2023-11
Chains
ETH, ARB, POL, BNB
Total stolen
~$87M
Victims
~137,000
Phishing sites
16,000+
Primary vector
Permit2 (EIP-2612) + Seaport/WalletConnect spoof
Source
Group-IB "Inferno Drainer" 2024-01-17
Dune
Primary source
PUBLIC DATA — SIGBOT Analysis
Flow Diagram
DRAIN~103k (reported) USDCPEEL— USDCSWAP— USDC → ETHMIXER3 deposits ETHBRIDGE~42% of traced USDTInferno collectorPeel-chain addressDEX routerTornado Cash poolCEX hot walletBinance / OKX / Bybit
Legend: ● drain · ● split/peel · ● swap/bridge · ● exchange entry
Each node links to its public source (report / dashboard). No unverified hashes are shown.
Timeline
◈ 2022-11 — operation starts
▲ peak activity window (per hop rows above)
■ largest victim identified
◆ developers announce shutdown
✎ Group-IB "Inferno Drainer" 2024-01-17 — source
Per-Hop Table
DEPTH ▲FROM ▲TO ▲ASSET ▲AMOUNT ▲PROTOCOL ▲TAG ▲TIME ▲SOURCE
1Victim (signs Permit2)Inferno collectorUSDC~103k (reported)Permit2DRAIN2023-05-18 (UTC)Group-IB report — Permit2 drain example
2Inferno collectorPeel-chain addressUSDC—TransferPEEL2023-05-18 (UTC)Group-IB report — 5-12 hop peel chain
3Peel-chain addressDEX routerUSDC → ETH—Uniswap V3SWAP2023-05-18 (UTC)Group-IB report — swap leg
4DEX routerTornado Cash poolETH3 depositsTornado CashMIXER2023-05-18 (UTC)Group-IB report — 3 Tornado deposits
5Tornado Cash poolCEX hot walletUSDT~42% of tracedBridge + transferBRIDGE2023-05-19 (UTC)Group-IB report — Binance/OKX/Bybit custody
6CEX hot walletBinance / OKX / BybitUSDT42% / 18% / 12%Custody pointEXCHANGE2023-05-19 (UTC)Group-IB report — custody split
Wallet-Vibe Cards
Inferno collector cluster (5 addr.)
Drainer fee splitter (20% dev, 80% affiliates)
First funded: per Group-IB, 2023-03
Activity window: 02:00–06:00 UTC (consistent) → BOT
Risk: 98/100 · Degen: 95/100 · Patience: 12/100
Connected wallets: 23
Cluster: Inferno-Dev
Peel-chain node
Single-recipient hops, same gas payer
First funded: per Group-IB, 2023-03
Activity window: 02:00–06:00 UTC (consistent) → BOT
Risk: 97/100 · Degen: 90/100 · Patience: 8/100
Connected wallets: 12
Cluster: Inferno-Peel-1
Largest victim 0xbb0d…d00b
Largest single victim (~$400k)
First funded: 2021-08-02 12:44 UTC
Activity window: 14:00–22:00 UTC → OWNER
Risk: 40/100 · Degen: 30/100 · Patience: 82/100
Connected wallets: 5
Cluster: Retail
Funding-Source Chart
▸ Fresh Binance withdrawals (reported): 62%
▸ Tornado Cash exits (reported): 18%
▸ Arbitrum bridge (reported): 12%
▸ Peel loops (reported): 8%
Confidence Table
FindingConfidenceBasis
Drainer developer fee wallet cluster (5 addresses)94%Group-IB: consistent 20% split across 4,800+ drains
Primary peel chain (5-12 hops)99%Group-IB: linear single-recipient hops, same gas payer
Exchange entries: Binance/OKX/Bybit100%Group-IB report — custody-point attribution
Mixer usage: Tornado Cash (3 deposits)87%Group-IB — entry/exit timing + amount correlation
Largest victim negotiation attempt100%Group-IB — on-chain message + Scam Sniffer screenshot
Prosecutor Summary
Inferno Drainer — SIGBOT Analysis (Public Data)

Between November 2022 and November 2023, the Inferno Drainer scam-as-a-service operation stole approximately $87 million from ~137,000 victims across Ethereum, Arbitrum, Polygon and BNB Chain.

Funds flowed from victims → drain transactions → a peel chain of 5-12 hops → Tornado Cash (3 deposits) → Binance, OKX and Bybit hot wallets. The developer fee (20-30%) was split across 5 identified collector addresses holding 250-400 ETH each at peak.

Trace reached custody points at Binance (42% of traced volume), OKX (18%) and Bybit (12%). The remaining 28% exited via Tornado Cash or remain in peel-chain addresses.

Based on public ledger data as of 2024-01-17. Identity determinations require law-enforcement action.

Fund ForensicsPricingFAQHow it works© 2026 SIGBOT — public ledger analysis only