{"id":71381,"date":"2024-02-14T05:20:26","date_gmt":"2024-02-14T09:20:26","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=71381"},"modified":"2024-02-14T05:20:29","modified_gmt":"2024-02-14T09:20:29","slug":"angel-drainer-steals-over-400k-from-several-crypto-wallets","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/angel-drainer-steals-over-400k-from-several-crypto-wallets\/","title":{"rendered":"Angel Drainer Steals Over $400K From Several Crypto Wallets"},"content":{"rendered":"\n

Reportedly, over $400,000 was stolen from 128 cryptocurrency wallets by the infamous phishing group Angel Drainer using a new attack vector that utilized Etherscan's verification utility to obscure the malicious nature of a smart contract<\/a>.<\/p>\n\n\n\n

\"Angel
Angel Drainer Steals Over $400K From Several Crypto Wallets<\/figcaption><\/figure>\n\n\n\n

Angel Drainer initiated the attack at 6:40 a.m. on February 12 by deploying a malicious Safe (formerly Gnosis Safe) vault contract, according to a blockchain security firm Blockaid's February 13 X post.<\/p>\n\n\n\n

\n

Today our researchers discovered yet another emerging attack vector from the Angel Drainer group \u2014 this time phishing users and leading them to a single Safe Vault contract where 128 wallets have been drained of $403k+ so far. All Blockaid-protected users are safe. \ud83e\uddf5 pic.twitter.com\/niffQDlciG\r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a><\/p>— Blockaid (@blockaid_) February 13, 2024<\/use><\/svg><\/span><\/a><\/blockquote>

Following the signature of 128 accounts on a “Permit2” transaction on the Safe Vault contract, $403,000 in funds was stolen.<\/p>\n\n\n\n

Blockaid stated that the swindle artists utilized a Safe Vault contract to create a “false sense of security,” given that Etherscan <\/a>verifies the contract's legitimacy automatically by appending a verification flag.<\/p>\n\n\n\n

Blockaid emphasized that its user base had not been “significantly impacted” and that the incident was not a direct assault on Safe. In addition to notifying Safe of the assault, the security firm stated it was attempting to prevent additional damage.<\/p>\n\n\n\n

\n

\u201cThis is not an attack on Safe [\u2026] rather they decided to use this Safe vault contract because Etherscan automatically adds a verification flag to Safe contracts, which can provide a false sense of security as it\u2019s unrelated to validating whether or not the contract is malicious.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n

Despite operating for only twelve months, Angel Drainer has reportedly emptied more than $25 million from close to 35,000 wallets, according to a post on Blockaid's X on February 5.<\/p>\n\n\n\n

\n

Today, the Angel Drainer Group celebrated one year in operation.

They've drained over $25M from nearly 35k wallets and are behind high profile drains like last year's Ledger Connect Kit and last week's Restake Farming attack.

We seek to protect every web3 user and put them out\u2026 pic.twitter.com\/U1Sg6sajd6<\/use><\/svg><\/span><\/a><\/p>— Blockaid (@blockaid_) February 5, 2024<\/use><\/svg><\/span><\/a><\/blockquote>

The EigenLayer restake farming attack and the $484,000 Ledger Connect Kit breach are two of the most notable attacks Angel Drainer has mounted recently.<\/p>\n\n\n\n

Blockaid explained that in the restake farming attack, Angel Drainer implemented a malicious queueWithdrawal function that, after users sign, would withdraw staking rewards to an address specified by the attackers.<\/p>\n\n\n\n

\n

\u201cBecause this is a new kind of approval method, most security providers or internal security tooling does not parse and validate this approval type. So in most cases it\u2019s marked as a benign transaction.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n

Scam Sniffer, a Web3 scam tracker, reports that in January, an estimated 40,000 users across various platforms, including OpenSea, Optimism, zkSync, Manta Network<\/use><\/svg><\/span><\/a>, and SatoshiVM, unfortunately, encountered phishing assaults, resulting in a cumulative loss of $55 million.<\/p>\n\n\n\n

The amount is projected to exceed the $295 million recorded in 2023, as stated in the 2023 Wallet Drainers Report by Scam Sniffer.<\/p>\n","protected":false},"excerpt":{"rendered":"

Reportedly, over $400,000 was stolen from 128 cryptocurrency wallets by the infamous phishing group Angel Drainer using a new attack vector that utilized Etherscan’s verification utility to obscure the malicious nature of a smart contract. Angel Drainer initiated the attack at 6:40 a.m. on February 12 by deploying a malicious Safe (formerly Gnosis Safe) vault […]<\/p>\n","protected":false},"author":12,"featured_media":71383,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[6845,18414,1652,2118],"class_list":["post-71381","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-etherscan","tag-angel-drainer","tag-crypto-wallets","tag-hacker"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/02\/image-40.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/71381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=71381"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/71381\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/71383"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=71381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=71381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=71381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}