Crypto Phishing Group Angel Drainer Reportedly Steals $400,000 From 128 Wallets

cryptonews.com:

Phishing group Angel Drainer stole over $400,000 from 128 crypto wallets after deploying a malicious vault contract yesterday.

According to an X post published on February 13 by blockchain security firm Blockaid, Angel Drainer employed a new attack vector that exploited Etherscan’s verification tool to conceal the malicious characteristics of a smart contract.

The attack occurred at 6:40 am on February 12 when Angel Drainer deployed a malicious Safe vault contract, Blockaid said.

At 6:41am UTC on Monday, February 12th, Angel Drainer group deployed a Safe vault contract— 0xbaee148df4bf81abf9854c9087f0d3a0ffd93dbb— which they have since used to phish and scam users, prompting them to sign a Permit2 with this Safe Vault as the operator. pic.twitter.com/8ydY9nQO2R

— Blockaid (@blockaid_) February 13, 2024

Following the deployment, users unknowingly authorized a ‘Permit2’ transaction on the compromised contract, culminating in the theft of $403,000.

The blockchain security firm noted that Angel Drainer specifically chose to use a Safe vault contract to instill an unfounded sense of security among users—a common tactic in crypto phishing schemes—as Etherscan automatically adds a verification flag to Safe contracts.

Blockaid emphasized that the attack was not a direct assault on Safe, clarifying that its user base had not experienced widespread consequences. The security firm also said that it had informed Safe about the attack and was working to mitigate any potential additional damage.

“This is not an attack on Safe […] rather they decided to use this Safe vault contract because Etherscan automatically adds a verification flag to Safe contracts, which can provide a false sense of security as it’s unrelated to validating whether or