Briefing
A sophisticated phishing campaign successfully compromised a 2-of-4 Safe multi-signature wallet, resulting in the theft of $3.047 million in USDC. The attacker meticulously crafted a fake, Etherscan-verified contract, then leveraged the Safe Multi Send mechanism within the Request Finance app to disguise a malicious approval as a routine transaction. This incident underscores the evolving threat landscape where social engineering combines with advanced on-chain deception to circumvent established security layers. The stolen funds were rapidly converted to Ethereum and funneled into Tornado Cash, obscuring the trail of assets.
Context
The digital asset ecosystem consistently faces threats from sophisticated social engineering tactics and contract manipulation. Pre-existing vulnerabilities often include reliance on visual inspection of addresses and transaction details, which attackers exploit through character mimicry and complex contract interactions. The prevailing attack surface for multi-signature wallets involves the integrity of the signing process and the clarity of transaction data presented to signers, both of which were exploited in this incident.
Analysis
The incident’s technical mechanics involved a multi-stage deception. The attacker first deployed a fake Etherscan-verified contract weeks in advance, programmed with legitimate-looking “batch payment” functions. On the day of the exploit, the victim, using the Request Finance app, unknowingly approved a malicious transaction. This approval, disguised by the Safe Multi Send mechanism, granted the attacker access to the wallet’s funds.
The attacker’s contract mimicked the intended recipient’s address by mirroring its first and last characters, making detection challenging for the victim. This chain of cause and effect demonstrates a calculated exploitation of user trust and the intricacies of multi-signature transaction processing.
Parameters
- Exploited Entity → Unidentified 2-of-4 Safe multi-signature wallet
- Vulnerability Type → Sophisticated Phishing via Malicious Contract Approval
- Financial Impact → $3.047 Million USDC
- Blockchain Affected → Ethereum
- Attack Mechanism → Fake Etherscan-verified contract, Safe Multi Send mechanism, Request Finance app interface
- Fund Laundering → Tornado Cash
- Detection → ZachXBT, SlowMist, Scam Sniffer
Outlook
Immediate mitigation for users involves extreme vigilance when approving on-chain transactions, especially those involving multi-send mechanisms. Protocols must enhance front-end security to provide clearer, unambiguous transaction details, flagging any suspicious contract interactions. This incident will likely establish new security best practices for multi-signature wallet interfaces and dApp integrations, emphasizing the need for robust transaction simulation and anomaly detection. Contagion risk exists for similar protocols that rely on standard approval flows susceptible to address spoofing and disguised malicious payloads.
Verdict
This sophisticated phishing attack represents a critical evolution in on-chain social engineering, demanding a fundamental shift in user verification practices and protocol-level transaction transparency.
Signal Acquired from → CryptoSlate
