Independent public-interest resource — not affiliated with Multiplifi or any wallet provider. We will never ask for your recovery phrase, private key, or a signature.
Drain census (chain-derived)
Built from inbound transfers to the drainer's collector addresses —
enumerated via alchemy_getAssetTransfers on BSC, 2026-10-14. Raw pull and
methodology are in the evidence repo; every figure here is reproducible from chain data.
The infrastructure
Role
Address
Notes
Drainer exec contract
0x3b2c3fdfadef5237f2d05e61949a56c5a80b2f0d
the "spender" in the fake-login approval
Operator EOA
0x3ef438c34ce51a697a24247fe033c4562c94f0fd
pays gas, calls the exec function (~1,030 txs)
Collector A (shared)
0x0c7c656126aa62625fdd8051eb69dc14aee8d37b
228 inbound since Sep-25
Collector B (incident)
0x150df10ddb710eb2c6e655728ff789754e683ad8
fresh — first inbound was the first documented victim
The numbers
documented230 drain events · 164 unique senders · since 2026-09-25. The shared
collector serves multiple campaigns — the Multiplifi window added a burst, but this is
a serial drainer operation, not a Multiplifi-only event.
Scope
Drain events
Unique senders
Window
Drainer's full book
230
164
2026-09-25 → 2026-10-14
Incident window (Oct 9–14)
41
27
Oct-09 → Oct-14
Assets drained
Asset
Transfers
Note
BNC4
30
phish-token
USDT
28
real
GSTOCK
18
phish-token
4Stock
12
phish-token
GM
9
aBnbBTCB
7
USDC
5
real
xUSDT
2
Multiplifi's yield token — first documented victim (~2,013 units)
plus ~20 smaller junk/phish assets — a sweep-everything profile
Timeline
When
What
2026-09-25
first inbound to shared collector — drainer already operating
2026-10-09
first reports of multipli.fi serving compromised frontend
2026-10-10
first documented drain via fake login (amioantho, ~2,013 xUSDT)
2026-10-10→14
27 unique senders drained in window
2026-10-14 23:51
latest inbound — still active
Caveats
Window attribution is temporal — senders drained Oct 9–14 are probable
frontend victims, but the shared collector also serves concurrent campaigns; some
window senders may belong elsewhere.
"1,000+ transactions" reported by the first victim refers to the operator's tx
count, not victim count.
Cross-chain: drainer/operator/collectors show no code or nonce on Base or Arbitrum —
BSC-only.