Ethereum

Foundation

Phishing group Angel Drainer has started using a new attack vector, targeting restaking platforms, analysts at Blockaid alarm.
Blockaid’s analysts have discovered a new attack vector performed by the Angel Drainer group, using a protocol to carry out an approval <a href="https://crypto.news/tag/crypto-hack/" target="_blank" rel="noopener noreferrer nofollow">farming attack</a> via the “queueWithdrawal” function. In <a href="https://twitter.com/blockaid_/status/1752847514393522260" target="_blank" rel="noopener noreferrer nofollow">an X thread</a> on Feb. 1, Blockaid shared affected wallet addresses, adding it is implementing a fix to safeguard users.
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
 ⚠️ Emerging web3 attack vector: Restake Farming ⚠️ Angel Drainer group has introduced a new attack vector utilizing a protocol to execute a novel form of approval farming attack through the 'queueWithdrawal' mechanism. 🧵(1/6) <a href="https://t.co/sYVu6iCfBh" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/sYVu6iCfBh</a>— Blockaid (@blockaid_) <a href="https://twitter.com/blockaid_/status/1752847514393522260?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">February 1, 2024</a>
 </blockquote>
 <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
Restaking rewards, introduced by EigenLayer, provide Ethereum (<a href="https://crypto.news/price/ethereum/" target="_blank" rel="noopener noreferrer nofollow">ETH</a>) stakers with new tokens. These tokens can be <a href="https://crypto.news/tag/staking/" target="_blank" rel="noopener noreferrer nofollow">restaked</a> in other decentralized applications, preserving the option to participate in protocols’ governance.
You might also like: <a href="https://crypto.news/near-foundation-and-eigen-labs-partner-to-enhance-ethereum-rollups/" rel="noopener noreferrer nofollow"> Near Foundation and Eigen Labs partner to enhance Ethereum rollups </a>
In the latest innovative attack, Angel Drainer has apparently made a new approval farming method through the “queueWithdrawal” function of the EigenLayer platform, approving a malicious “withdrawer” to withdraw staking rewards to the attacker’s address, the firm says.
<blockquote class="wp-block-quote">
 “Unlike the regular ERC20 ‘approve’ method, this is a special kind of approval that is needed due to the nature of Ethereum staking.” <cite>Blockaid</cite>
</blockquote>
Blockaid emphasizes that this new attack vector involves a distinctive approval method, leading to most security providers or internal security tools not parsing and validating this approval type. To further elude detection, the attacker employs the so-called “CREATE2” mechanism to approve withdrawals to an empty address, as revealed by Blockaid.
The firm has notified the EigenLayer team about the “ongoing attack.” In a <a href="https://x.com/eigenlayer/status/1752863699830731063?s=20" target="_blank" rel="noopener noreferrer nofollow">separate X post</a>, EigenLayer confirmed the attack, urging users to stay vigilant amidst the increasing phishing attacks targeting its users.
Read more: <a href="https://crypto.news/dydx-foundation-partners-with-stride-to-launch-liquid-staking/" rel="noopener noreferrer nofollow"> dYdX Foundation partners with Stride to launch liquid staking </a>

Angel Drainer targets restaking platforms with new attack vector, Blokcaid warns

crypto.news

Other articles published on Feb 1, 2024

Supermicro Beats Q2 Estimates as AI Rush Intensifies

Bitcoin Price Prediction: BTC Faces Tough Resistance Battle

Grayscale unveils broad crypto sector investment framework

DeFi Protocol Velar Raises $3.5M to Build First Bitcoin DEX for Perpetual Swaps

Bard’s latest update: users in Nigeria can now access Gemini Pro and generate AI images

5 Best Cheap Crypto to Buy Now Under 1 Dollar January 30

Join our free newsletter for daily crypto updates!