Briefing
A sophisticated phishing attack resulted in the unauthorized transfer of assets from a 2-of-4 Safe multi-signature wallet. The attacker manipulated the transaction approval process by leveraging a fake Etherscan-verified contract, embedding a malicious approval within a seemingly routine multi-send operation. This incident highlights the persistent threat of social engineering combined with technical deception in the DeFi ecosystem. The total financial impact of this breach is $3.047 million in USDC.
Context
Prior to this incident, a prevailing risk factor involved user reliance on superficial visual inspection for complex transaction approvals. Attackers frequently leverage the perceived legitimacy of verified contracts and the inherent complexity of multi-send operations. This creates an attack surface where subtle discrepancies in transaction data can lead to significant asset loss.
Analysis
The incident’s technical mechanics involved compromising the user’s transaction approval process within the Request Finance app, specifically targeting a Safe multi-signature wallet. The attacker initiated the chain of cause and effect by deploying a fake, Etherscan-verified contract designed to mimic a legitimate “Batch Payment” contract. This counterfeit contract then exploited the Safe Multi Send mechanism, embedding a malicious approval within what appeared to be a standard transaction.
The victim unknowingly authorized this malicious contract, granting the attacker access to drain $3.047 million in USDC from their 2-of-4 Safe multi-signature wallet. The stolen funds were subsequently swapped for Ethereum and routed through Tornado Cash, a privacy protocol, for obfuscation, demonstrating a clear intent to conceal the illicit trail.
Parameters
- Protocol Targeted → Unidentified Multi-signature Wallet Owner
- Attack Vector → Sophisticated Phishing (Safe Multi Send Exploitation)
- Financial Impact → $3.047 Million USDC
- Blockchain Affected → Ethereum
- Vulnerability Class → Transaction Authorization Manipulation
- Forensic Identifier → ZachXBT Flagged Incident
- Attacker Tactic → Fake Etherscan-Verified Contract
- Mitigation Post-Incident → Request Finance Patched Vulnerability
Outlook
Immediate mitigation steps for users include enhanced scrutiny of all transaction details, particularly for multi-send approvals, and the consistent use of hardware wallets with clear signing displays. The potential for second-order effects on similar protocols is high, as these sophisticated phishing tactics are readily adaptable to other DeFi platforms and multi-sig setups. This incident will likely establish new security best practices, emphasizing the critical need for more robust transaction simulation tools and clearer, more intuitive approval interfaces for complex contract interactions to prevent future exploitation.
Verdict
This incident underscores the critical evolution of social engineering tactics, demanding heightened vigilance and advanced verification mechanisms for all on-chain interactions.
Signal Acquired from → CryptoSlate
