Edit: Angel Drainer — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

## Overview

Angel Drainer was a "malware-as-a-service" wallet drainer focused on EVM chains. Like other drainer crews it gave affiliates ready-made infrastructure — on-demand smart contracts and tailored malicious transactions designed to sweep funds when a victim signs an approval, "permit," or fake "claim." Per Ledger's incident report, proceeds were split roughly 85% to the affiliate and 15% to Angel Drainer. [1][2]

## Ledger Connect Kit attack

Angel Drainer is best known for the December 14, 2023 supply-chain compromise of Ledger's "Connect Kit," a JavaScript library used by hundreds of dApps. A phishing attack on a former Ledger employee's npm credentials let attackers publish malicious versions (1.1.5–1.1.7) carrying the Angel Drainer payload; because many sites loaded the library from a CDN, the malicious code executed widely and automatically. The active draining lasted about two hours and stole roughly $500,000–$600,000 before Ledger pushed a clean version. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit