The Exit Drain:
how Aurum robbed the wallets on the way out

The pivot from Ponzi to outright theft

The subject of this report — Aurum Foundation / NEYRO

The first report showed a fake “AI trading bot” that pooled deposits and quietly extracted them. This is what came next. Around 21–23 July, the deposits stopped — and an “airdrop season 2” appeared. To claim it, users were asked to reconnect their wallet, which triggered a MetaMask “increase spending cap” prompt. Approving it doesn’t move money. It hands a stranger’s contract permission to take your tokens later — and that is exactly what happened.

A contract built for one job: emptying approved wallets

We pulled the drainer contract’s code from the chain and decoded it. It is small, purpose-built, and self-incriminating. It has no legitimate use.

// Two hard-coded addresses baked into the contract:
OWNER     = 0x98e7906b5ad64597971a991e20419078b6174e41  // the only caller
COLLECTOR = 0x93d77915179b45b54eb4268be08afe1771928765  // where funds go

function transferBatch(address token, address[] froms, uint256[] amounts) onlyOwner {
    for each victim in froms:
        token.transferFrom(victim, COLLECTOR, amount);   // pull, using the approval
}
function pause() / unpause()  onlyOwner              // operator can switch it on/off

Thousands of wallets, pulled in batches

On the collector’s own transaction history you can watch it happen: repeated transferBatch calls, each sweeping USDT and USDC out of a fresh set of wallets. Some rows are even flagged “Scam tx” by the wallet-tracking tools themselves.

Mapped out, the pattern is unmistakable: a dense swarm of thousands of victim wallets (green, flowing in) collapsing into the single collector node, which then pushes out through a handful of exits (red, on the right).

The trail bridges out — and that’s where it gets interesting

Where does the stolen money go? The collector consolidates it and bridges it out through Relay, a cross-chain bridge (its outgoing transfers land on an address BSCScan labels Relay: Depository), alongside a second, unlabelled consolidation wallet 0x47dcff95…94a2a. A bridge moves the funds to another chain and pays them out from its own liquidity — which means the final exchange destination sits on the far side of that bridge, not in a straight line from the collector.

The gas trail ties it all together

Running a drainer across four chains costs “gas” — small amounts of each chain’s native coin to pay for transactions. All of it came from one distributor wallet, 0x60FE…dd761, which seeded the collector on BSC, Ethereum, Base and Arbitrum on the same day the drain began. That wallet was in turn funded from a single upstream wallet, 0xff72…42aEE.

One hand on the trigger — and one door to a name

We can map the operator’s own wallet cluster with confidence. It is a small, tight ring of self-controlled wallets, and — unlike the drained money, which bridges away — one of them made a mistake that points at a real-world company.

Proven to be one operator, three independent ways

• The drainer contract hard-codes the collector as its destination and a single owner address (0x98e7…74e41) as the only address allowed to run it.
• That owner’s first funding — on the day the drain began — came from the collector itself, across all four chains; the owner later tops the collector’s gas back up. Money flows both ways between them.
• BSCScan independently labels both wallets under the same name: “Aurum Foundation 2.”

Around this pair sits a handful of small wallets (0x8fc13…, 0x60Df5…, 0x47dcff95…) that pass a few thousand dollars back and forth for fees and housekeeping — all looping within the same ring.

The one door: a Coinbase withdrawal

On 26 July, the operator’s trigger wallet received a withdrawal from a Coinbase hot wallet (USDC, on the Base chain). Coinbase is US-based and among the most strongly identity-verified exchanges in the world — a withdrawal only happens when a verified account holder initiates it. The operator’s internal wallet is not an address advertised to victims, so a Coinbase payout landing on it points to the operator’s own Coinbase account.

If you signed the “airdrop” approval, you are still exposed

The collector was still receiving fresh transferBatch pulls within the hour of writing. The approval doesn’t expire — anyone who signed it and still holds tokens in that wallet can be drained again at any moment.

Every address, one click away

Key transaction hashes

What we do — and don’t — claim