Safe

PlayDapp

Security

Gnosis

<a href="https://bitcoinist.com/ledger-supply-chain-attack-over-480000-drained/" target="_blank" rel="noopener ">Web3 security firm Blockaid</a> recently reported another significant security breach that Angel Drainer carried out. The notorious phishing group is said to have drained 128 crypto wallets of their funds.&nbsp; 
<img loading="lazy" decoding="async" class="wp-image-281328 size-large" src="https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?resize=980%2C468" alt="Crypto Ethereum ETH ETHUSDT" width="980" height="468" srcset="https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=2372 2372w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=980 980w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=2048 2048w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/02/Ethereum-ETH-ETHUSDT.png?w=1140 1140w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1"> 
<h2 id="how-these-wallets-were-drained">How These Wallets Were Drained</h2> 
Blockaid revealed in an X (formerly Twitter) <a href="https://x.com/blockaid_/status/1757469196236243294?s=20" target="_blank" rel="noopener nofollow">post</a> that Angel Drainer phished users and led them to a single Safe (formerly Gnosis Safe) Vault contract, where the group then managed to <a href="https://bitcoinist.com/hackers-attack-mangomarkets-templedao-qan-defi/" target="_blank" rel="noopener ">drain these wallets of over $403,000</a>. The incident, which began at 6:41 am on February 12th, is said to have begun with the phishing group deploying a Safe Vault contact to lure these users. 
Oblivious to the scam being perpetrated, these users signed a “Permit2 with this Safe Vault as the operator.” This <a href="https://bitcoinist.com/inferno-drainer-accomplice-in-70m-fraud/" target="_blank" rel="noopener ">Permit2 exploit</a> allows these hackers unlimited approval to move these funds across different smart contracts. Meanwhile, Blockaid noted that this wasn’t an attack on Safe, and its users are not “broadly impacted.” 
Angel Drainer is said to have used the Safe Vault contract because “<a href="https://bitcoinist.com/solana-etherscan-acquires-solscan/" target="_blank" rel="noopener ">Etherscan</a> automatically adds a verification flag verification flag to Safe contacts.” The drawback is that this verification tool “can provide a false sense of security as it’s unrelated to validating whether or not the contract is malicious.” 
Blockaid added that they had already notified the Safe team and were working with their customers and partners to limit the attack’s impact. Safe has, however, not issued any statement regarding this incident.&nbsp; 
<h2 id="the-infamous-angel-drainer-group">The Infamous Angel Drainer Group</h2> 
Blockaid had recently highlighted how the Angel Drainer Group had celebrated one year in operation. During that period, the phishing group is said to have drained over $25 million from nearly 35,000 wallets. Interestingly, they were behind the <a href="https://bitcoinist.com/ledger-supply-chain-attack-over-480000-drained/" target="_blank" rel="noopener ">Ledger supply chain attack</a>, which led to over $480,000 being drained from different wallets.&nbsp;&nbsp; 
More recently, the group carried out a ‘Restake Farming attack.’ Blockaid revealed in an <a href="https://x.com/blockaid_/status/1752847514393522260?s=20" target="_blank" rel="noopener nofollow">X post</a> how Angel Drainer had introduced a new attack vector that executes a “novel form of approval farming attack through the ‘queueWithdrawal’ mechanism.”&nbsp; 
Specifically, the phishing group was said to have introduced this novel form of approval farming through the queueWithdrawal mechanism on the <a href="https://bitcoinist.com/ethereum-drained-exchanges-eigenlayer-eth-bulls/" target="_blank" rel="noopener ">EigenLayer protocol</a>. A user signing this ‘queueWithdrawal’ transaction allows the attacker to withdraw the wallet’s staking rewards from the protocol to any address they choose.&nbsp; 
<a href="https://bitcoinist.com/crypto-breach-hackers-make-off-with-900k/" target="_blank" rel="noopener ">Security </a>breaches in the crypto space continue to be one of the deterrents from crypto adoptions.&nbsp; 
Chart from Tradingview

128 Crypto Wallets Drained by New Attack, Is Your Money Safe?

Table of Contents

Bitcoinist

Outros artigos publicados em 14 de fev. de 2024

SEC Chair Gary Gensler criticizes Bitcoin, calls out its role in ransomware

MicroStrategy Buys $37 Million in $BTC as VC’s Eye New Memecoin

Blockchain Festival and Traders Fair 2024: Shaping the Future of Finance and Blockchain in Singapore

Ripple CEO Celebrates Company's Epic Wins: Details

MANTA and Jupiter Experience Dips Amidst Market Corrections; Investors Swarm to Borroe Finance fo...

Bitcoin network prepares for a significant increase in its difficulty

Join our free newsletter for daily crypto updates!