Crypto Phishing Group Angel Drainer Reportedly Steals $400,000 From 128 Wallets

Brian Yue
Last updated: | 1 min read
crypto phishing
Image by Brian Yue, Midjourney

Crypto phishing group Angel Drainer stole over $400,000 from 128 crypto wallets after deploying a malicious vault contract yesterday.

According to an X post published on February 13 by blockchain security firm Blockaid, Angel Drainer employed a new attack vector that exploited Etherscan’s verification tool to conceal the malicious characteristics of a smart contract.

Angel Drainer Goes Crypto Phishing


The attack occurred at 6:40 am on February 12 when Angel Drainer deployed a malicious Safe vault contract, Blockaid said.

Following the deployment, users unknowingly authorized a ‘Permit2’ transaction on the compromised contract, culminating in the theft of $403,000.

The blockchain security firm noted that Angel Drainer specifically chose to use a Safe vault contract to instill an unfounded sense of security among users—a common tactic in crypto phishing schemesas Etherscan automatically adds a verification flag to Safe contracts.

Blockaid emphasized that the attack was not a direct assault on Safe, clarifying that its user base had not experienced widespread consequences. The security firm also said that it had informed Safe about the attack and was working to mitigate any potential additional damage.

“This is not an attack on Safe […] rather they decided to use this Safe vault contract because Etherscan automatically adds a verification flag to Safe contracts, which can provide a false sense of security as it’s unrelated to validating whether or not the contract is malicious,” Blockaid said.

Angel Drainer’s Track Record


In just 12 months of operation, Angel Drainer has managed to siphon off more than $25 million from nearly 35,000 wallets in that short period, according to a February 5 post by Blockaid.

Additionally, the group executed other major breaches, including the 2023 Ledger Connect Kit hack and the recent EigenLayer restake farming attack.

The restake farming attack conducted by Angel Drainer involved the usage of a malicious “queueWithdrawal” function. Once users sign, this function would withdraw staking rewards to an address chosen by the attackers, the security firm explained.