As Non-Fungible Tokens (NFTs) continue to grow in popularity, NFT users have become targets of phishing attacks by cybercriminals, called NFT drainers. Over the last year, \$100 million worth of NFTs were stolen by drainers, and their presence remains as a serious threat to the NFT trading space. Since NFTs are different from cryptocurrencies, existing work on detecting Ethereum phishers is unsuitable to detect NFT drainers. Moreover, no work has yet comprehensively investigated the behaviors of drainers in the NFT ecosystem. In this paper, we present the first study on trading behavior of NFT drainers and present the first dedicated NFT drainer detection system. We extract data of 83M NFT transactions from the Ethereum blockchain and collect 742 drainer accounts from five sources. We find drainers have significantly different transaction context and social context compared to regular users. With the insights gained from our analysis, we design an automatic drainer detection system, DRAINCLoG, that uses graph neural networks to capture the complex relationships in the NFT ecosystem. Our model effectively captures NFT transaction contexts and social contexts using an NFT-User graph and a User graph, respectively. Evaluated on real-world NFT transaction data, we prove the model's effectiveness and robustness.

翻译：随着非同质化代币(NFT)的日益普及，NFT用户已成为网络犯罪分子实施钓鱼攻击的目标，此类攻击者被称为NFT盗取者。过去一年间，价值1亿美元的NFT被盗取者窃取，其存在对NFT交易领域构成严重威胁。由于NFT与加密货币存在本质差异，现有的以太坊钓鱼者检测方法并不适用于NFT盗取者检测。此外，目前尚未有研究对NFT生态系统中盗取者的行为模式进行系统性探究。本文首次对NFT盗取者的交易行为展开研究，并提出首个专用NFT盗取者检测系统。我们从以太坊区块链提取8300万条NFT交易数据，通过五个来源收集742个盗取者账户。研究发现，与常规用户相比，盗取者具有显著不同的交易情境特征与社会情境特征。基于分析所得洞察，我们设计了自动化的盗取者检测系统DRAINCLoG，该系统采用图神经网络捕获NFT生态系统中复杂的关联关系。该模型分别通过NFT-用户图与用户图有效捕获NFT交易情境与社会情境。基于真实世界NFT交易数据的评估验证了模型的有效性与鲁棒性。