Briefing
A sophisticated phishing campaign successfully compromised an investor’s 2-of-4 Safe multi-signature wallet on September 11, 2025. This attack vector leveraged a fake Etherscan-verified contract and the Safe Multi Send mechanism, tricking the victim into authorizing a malicious transaction. The primary consequence is the direct loss of $3.047 million in USDC, which the attacker swiftly converted to Ethereum and laundered through Tornado Cash. This incident underscores the escalating sophistication of social engineering tactics targeting high-value digital assets.
Context
Prior to this incident, the digital asset landscape faced persistent threats from increasingly sophisticated phishing operations. Attackers routinely leverage social engineering and contract impersonation to bypass user vigilance. The prevailing attack surface includes transaction approval mechanisms, where users inadvertently grant malicious contracts access to their funds. This exploit highlights the critical risk posed by deceptive contract verification and the complexities of multi-send transaction approvals.
Analysis
The attacker executed a multi-stage phishing operation, compromising an investor’s multi-signature wallet. This attack began with the deployment of a fake, yet Etherscan-verified, contract weeks in advance, programmed to mimic legitimate batch payment functions. On the day of the exploit, the victim interacted with the Request Finance app interface, unknowingly approving a malicious transaction disguised within a routine Safe Multi Send operation.
The attacker crafted the fraudulent contract address to closely resemble the legitimate one, deceiving the victim’s scrutiny. This method successfully bypassed standard approval checks, enabling the unauthorized transfer of funds.
Parameters
- Victim → Unidentified crypto investor’s 2-of-4 Safe multi-signature wallet
- Vulnerability → Sophisticated phishing via fake Etherscan-verified contract and Safe Multi Send mechanism abuse
- Funds Lost → $3.047 million in USDC
- Blockchain Affected → Ethereum
- Attack Date → September 11, 2025
- Attacker’s Action → Swapped USDC for Ethereum, laundered through Tornado Cash
- Expert Confirmation → ZachXBT, SlowMist founder Yu Xian, Scam Sniffer
- Leveraged Interface → Request Finance app
Outlook
This incident mandates a reevaluation of user transaction verification processes and heightened awareness against contract impersonation. Users must exercise extreme caution when approving transactions, particularly those involving multi-send mechanisms or interactions with third-party applications. Protocols and security firms will likely prioritize advanced detection mechanisms for deceptive contract addresses and more robust front-end security to prevent similar social engineering exploits. This event reinforces the need for continuous user education on sophisticated phishing tactics.
Verdict
This sophisticated phishing attack on a multi-signature wallet establishes a critical precedent for refined social engineering tactics, demanding immediate, comprehensive advancements in user education and transaction verification protocols across the digital asset ecosystem.
Signal Acquired from → cryptoslate.com
