Phishing scammers utilizing crypto drainers appear to be no longer directing stolen funds to centralized exchanges, turning instead to swap protocols and bridges.

Cybercriminals operating drainers have changed their strategy significantly, with the majority of stolen funds now flowing into decentralized finance (defi) protocols, a notable change from 2020 when centralized exchanges were the primary destination.

Data from Chainalysis reveals that in 2023, nearly 75% of funds stolen via crypto drainers were funneled into defi, a stark contrast to 2020, where over 90% ended up in centralized exchanges. Analysts at Chainalysis also observed that certain drainers appear to be utilizing gambling services, “though on a much smaller scale.”

The New York-headquartered blockchain intelligence firm notes that the quarterly growth rate in value stolen by these drainers “has even exceeded value stolen by ransomware,” a category previously noted for its rapid growth.

The real scale of phishing activity remains unclear, Chainalysis acknowledged, citing the difficulty in tracking the total amounts stolen by drainers “given that many crypto drainer scams are not reported.”

As crypto.news earlier reported, ransomware attacks involving payments decreased by 46% in 2023 due to an increasingly saturated ransomware market and lower barriers to entry. Chainalysis claims the 46% decline in ransomware payments can be partly credited to “enhanced cyber resilience among organizations,” adding that companies now possess a better understanding of the threats they face.