Briefing
A sophisticated phishing attack successfully drained $3.047 million in USDC from a 2-of-4 Safe multi-signature wallet on September 11, 2025. This incident highlights the critical risk of disguised malicious contract approvals within seemingly routine transactions. The attacker leveraged a fake, Etherscan-verified contract, mirroring the legitimate recipient’s address, to bypass user scrutiny and execute the illicit transfer. The immediate consequence for the affected user was a significant capital loss, with stolen funds rapidly converted to Ethereum and laundered via Tornado Cash.
Context
Prior to this incident, the digital asset landscape consistently faced advanced social engineering and contract manipulation tactics. Attack surfaces often include front-end interfaces, compromised administrative keys, and vulnerabilities in user authorization flows. The prevailing risk factors included the increasing sophistication of phishing schemes, which leverage legitimate-looking infrastructure to trick users into granting malicious approvals. This exploit leveraged a known class of vulnerability → the deceptive embedding of malicious logic within standard transaction mechanisms.
Analysis
The attack initiated with the deployment of a fake, Etherscan-verified contract approximately two weeks before the exploit. This contract was meticulously crafted to mimic a legitimate batch payment function, lending it an undeserved air of authenticity. The attacker then exploited the Safe Multi Send mechanism, disguising a malicious approval within what appeared to be a standard transaction. The victim, interacting through the Request Finance app interface, unknowingly authorized transfers to this fraudulent contract.
This chain of events allowed the attacker to siphon $3.047 million in USDC, subsequently swapping the assets for Ethereum and funneling them through Tornado Cash to obscure the financial trail. The success of this attack underscores the attacker’s advanced preparation and the deceptive power of mimicking trusted on-chain entities.
Parameters
- Targeted Entity → 2-of-4 Safe multi-signature wallet
- Attack Vector → Sophisticated Phishing via Malicious Contract Approval
- Financial Impact → $3.047 Million USDC
- Blockchain → Ethereum
- Exploited Mechanism → Safe Multi Send
- Deception Method → Fake, Etherscan-verified contract mimicking legitimate address
- Facilitating Application → Request Finance app interface
- Attribution/Discovery → ZachXBT, SlowMist founder Yu Xian, Scam Sniffer
Outlook
Immediate mitigation requires users to exercise extreme vigilance when approving transactions, manually verifying all contract addresses and approval details before signing. Protocols must enhance their front-end security to detect and warn against suspicious contract interactions, even when originating from verified contracts. This incident establishes a new benchmark for phishing sophistication, demanding that security audits extend beyond code logic to include comprehensive assessments of user interaction flows and the potential for social engineering at the application layer. The contagion risk extends to any multi-signature wallet or DeFi protocol relying on user approvals via third-party interfaces.
Verdict
This incident definitively signals a critical escalation in phishing attack sophistication, necessitating an immediate and fundamental shift towards rigorous manual transaction verification and enhanced application-layer security across the digital asset ecosystem.
Signal Acquired from → CryptoSlate
