Briefing
An unidentified crypto investor’s 2-of-4 Safe multi-signature wallet was compromised in a sophisticated phishing attack, resulting in the loss of $3.047 million in USDC. The attacker exploited the Safe Multi Send mechanism, disguising malicious approval requests within seemingly routine transactions. This incident highlights a critical vulnerability in user interaction with decentralized applications, where trust in contract verification can be weaponized.
Context
The prevailing attack surface involves user interaction with decentralized applications, where visual verification of transaction details remains a primary defense. This exploit leveraged the persistent threat of social engineering, combined with the increasing sophistication of malicious contract deployments. Prior to this incident, the ecosystem grappled with similar classes of vulnerabilities where attackers mimic legitimate entities to induce user approvals.
Analysis
The incident’s technical mechanics involved compromising user trust through a meticulously crafted phishing scheme. The attacker deployed a fake, Etherscan-verified contract designed to mimic a legitimate one, ensuring its first and last characters matched the intended recipient’s address. The victim unknowingly authorized transfers through two consecutive transactions via the Request Finance app interface.
This deceptive approval, leveraging the Safe Multi Send mechanism, granted the attacker access to the victim’s funds. Subsequently, $3.047 million in USDC was drained, swiftly swapped for Ethereum, and routed to Tornado Cash for transaction obfuscation.
Parameters
- Protocol/Wallet Targeted → Unidentified Crypto Investor’s 2-of-4 Safe Multi-signature Wallet
- Vulnerability Type → Sophisticated Phishing (Malicious Approval Disguise)
- Financial Impact → $3.047 Million USDC
- Blockchain Affected → Ethereum
- Attack Vector → Fake Etherscan-verified contract, Safe Multi Send exploitation
- Key Security Researchers → ZachXBT, SlowMist (Yu Xian), Scam Sniffer
- Obfuscation Method → Tornado Cash
- Exploit Date → September 11, 2025 (flagged by ZachXBT)
Outlook
Immediate mitigation demands extreme vigilance from users when approving transactions, extending beyond superficial address checks. This event will likely prompt increased scrutiny on decentralized application interfaces and multi-signature wallet approval mechanisms, potentially leading to enhanced visual cues for detecting malicious approvals. Protocols may implement more robust pre-transaction verification layers and comprehensive user education on advanced phishing tactics to counter these evolving threats.
Verdict
This incident unequivocally demonstrates the escalating sophistication of social engineering in Web3, demanding a paradigm shift towards enhanced user education and integrated protocol-level verification to fortify digital asset security.
Signal Acquired from → CryptoSlate.com
