DRAINCLoG: Detecting Rogue Accounts with Illegally-obtained NFTs using Classifiers Learned on Graphs

As Non-Fungible Tokens (NFTs) continue to grow in popularity, NFT users have become targets of phishing attacks by cybercriminals, called NFT drainers. Over the last year, \$100 million worth of NFTs were stolen by drainers, and their presence remains as a serious threat to the NFT trading space. Since NFTs are different from cryptocurrencies, existing work on detecting Ethereum phishers is unsuitable to detect NFT drainers. Moreover, no work has yet comprehensively investigated the behaviors of drainers in the NFT ecosystem. In this paper, we present the first study on trading behavior of NFT drainers and present the first dedicated NFT drainer detection system. We extract data of 83M NFT transactions from the Ethereum blockchain and collect 742 drainer accounts from five sources. We find drainers have significantly different transaction context and social context compared to regular users. With the insights gained from our analysis, we design an automatic drainer detection system, DRAINCLoG, that uses graph neural networks to capture the complex relationships in the NFT ecosystem. Our model effectively captures NFT transaction contexts and social contexts using an NFT-User graph and a User graph, respectively. Evaluated on real-world NFT transaction data, we prove the model's effectiveness and robustness.