Briefing
A sophisticated phishing attack successfully compromised an unidentified investor’s 2-of-4 Safe multi-signature wallet, resulting in the unauthorized transfer of assets. The primary consequence involved the draining of over $3 million in USDC, which the attacker rapidly converted to Ethereum and routed through Tornado Cash. This incident highlights a critical vulnerability in user transaction verification processes and the evolving tactics of threat actors. The total financial impact of the exploit stands at $3.047 million in USDC.
Context
Prior to this incident, the digital asset landscape has consistently faced persistent phishing threats targeting user approvals and wallet permissions. The prevailing attack surface includes interfaces where users authorize transactions, making them susceptible to social engineering and malicious contract interactions. A known class of vulnerability involves attackers deploying seemingly legitimate, Etherscan-verified contracts to masquerade as trusted entities, a tactic this exploit effectively leveraged.
Analysis
The attack initiated with the attacker deploying a fake, Etherscan-verified contract weeks in advance, programmed with deceptive “batch payment” functions. The specific system compromised was the victim’s multi-signature wallet, facilitated through the Request Finance app interface. The attacker crafted the fraudulent contract to mirror the legitimate recipient’s address, using identical first and last characters.
This enabled the malicious approval to be disguised within the Safe Multi Send mechanism, appearing as a routine authorization. The chain of cause and effect shows the attacker’s strategic preparation, exploiting the victim’s trust and the complexity of transaction details to gain unauthorized control over funds.
Parameters
- Protocol/Wallet Targeted → Unidentified investor’s 2-of-4 Safe multi-signature wallet
- Vulnerability Type → Sophisticated Phishing, Malicious Contract Approval
- Financial Impact → $3.047 Million USDC
- Blockchain Affected → Ethereum
- Attack Vector Detail → Fake Etherscan-verified contract mimicking legitimate address, exploiting Safe Multi Send mechanism
- On-Chain Forensics → Funds swapped to Ethereum and routed to Tornado Cash
- Initial Flagging → ZachXBT on September 11, 2025
- App Interface Exploited → Request Finance app
Outlook
Immediate mitigation steps for users involve heightened scrutiny of all transaction approval requests, particularly when interacting with multi-send mechanisms. Users must verify the full contract address and not solely rely on partial matching. This incident will likely establish new security best practices emphasizing enhanced client-side validation and improved user interface transparency for complex transaction types. The contagion risk extends to any protocol or user relying on similar multi-send or batch transaction functionalities without robust, explicit authorization checks.
Verdict
This incident underscores the critical necessity for advanced user education and robust protocol-level safeguards against increasingly sophisticated social engineering and contract impersonation tactics.
Signal Acquired from → cryptoslate.com
