Multisig Wallet Compromise: $40 Million Stolen by Crypto Attacker

In a recent incident, a cryptocurrency attacker seized control of a whale's multisig wallet just minutes after its creation and has since been methodically draining funds.

Key Takeaways

A whale's multisig wallet was compromised shortly after its creation.
Approximately $27.3 million has been drained, with potential losses exceeding $40 million.
The attacker has been laundering the stolen funds over several weeks.
Flaws in the multisig wallet's design and potential attack vectors are concerning.
Advanced AI models are capable of exploiting smart contract vulnerabilities.

Attacker takes over multisig minutes after creation, drains up to $40M slowly

A Well-Planned Attack

On Thursday, the blockchain security firm PeckShield revealed that a whale's multisig wallet lost around $27.3 million due to a compromised private key. The attacker has successfully laundered approximately $12.6 million, equivalent to 4,100 Ether. However, new insights from Yehor Rudytsia, head of forensic at Hacken Extractor, suggest total losses could be as high as $40 million, with initial signs of theft tracing back to November 4.

According to Rudytsia, the multisig wallet labeled as “compromised” likely wasn't under the victim’s control for long. On-chain data indicates that while the wallet was created on November 4 at 7:46 am UTC, ownership was switched to the attacker just six minutes afterward. "It seems highly probable that the attacker created this multisig and moved funds there, then immediately reconfigured the owner to be themselves," Rudytsia noted.

Attacker laundering funds in batches. Source: PeckShield

A Cautious Approach

Once in possession of the wallet, the attacker has adopted a cautious approach. They executed deposits to Tornado Cash in increments over several weeks, starting with 1,000 ETH on November 4 and continuing with smaller transactions well into December. Currently, it is estimated that around $25 million in assets is still held in the multisig wallet under the attacker’s control.

Rudytsia raised alarms about the wallet’s configuration: it operated on a “1-of-1” basis, meaning only one signature was needed to validate transactions, which deviates from the standard concept of a multisig wallet. Abdelfattah Ibrahim, a DApp auditor at Hacken, pointed out several potential attack methods. These could involve malware or information stealers on the signer's device, phishing schemes tricking users into approving illicit transactions, or weak security practices like storing keys in plain text or sharing devices among multiple signers.

“To mitigate this risk, it is essential to keep signing devices isolated as cold storage and to verify transactions beyond the user interface,” Ibrahim recommended.

The Rise of AI in Exploit Development

As reported by Cointelegraph, recent research from Anthropic and the Machine Learning Alignment & Theory Scholars (MATS) group discovered that state-of-the-art AI models can create genuine and profitable smart contract exploits. In controlled experiments, models such as Anthropic’s Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI’s GPT-5 collectively produced exploits valued at $4.6 million, demonstrating the technical feasibility of autonomous exploitation using readily available models.

Further testing revealed that Sonnet 4.5 and GPT-5 could identify vulnerabilities in nearly 2,850 recently launched smart contracts, discovering two previously unknown zero-day flaws and generating exploits valued at $3,694, slightly surpassing the $3,476 needed to produce these exploits.

Related Insights

The implications of such attacks and exploitations are vast. Understanding security measures and evolving threats is crucial for anyone involved in the cryptocurrency space, especially regarding safeguarding assets within multisig wallets and beyond.

Magazine: 2026 is the year of pragmatic privacy in crypto — Canton, Zcash, and more