Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash
Private whale's Gnosis Safe multisig (Ethereum)
A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.
Why this severity: $27M reported stolen, 1 victims, still active.
- Started
- Nov 4, 2025
- Closed
- Jan 6, 2026
- Chains
- Ethereum
- Reported stolen
- $27M
- Victims
- 1
At risk
- Private whale's Gnosis Safe multisig (Ethereum)
- Ethereum wallets
What to do now
- Open your Safe settings and check the owner list and threshold. Any unfamiliar owner, or a threshold of 1, means the wallet is at risk.
- If you suspect a signer key is exposed, move funds to a new Safe with fresh keys created on hardware wallets.
Stay safe
Am I affected?
This was one private wallet. You face the same risk if you hold funds in a Safe or other multisig where one key alone can approve transactions, or if a signer key has ever sat on an internet-connected machine that could be infected.
What to do now
- Open your Safe settings and check the owner list and threshold. Any unfamiliar owner, or a threshold of 1, means the wallet is at risk.
- If you suspect a signer key is exposed, move funds to a new Safe with fresh keys created on hardware wallets.
How to avoid this
- Use a real threshold (for example 2-of-3) with each key on a separate hardware wallet held in a different place.
- Never store seed phrases or private keys as plain text, in screenshots or in cloud backups.
- Set alerts for owner changes and large outgoing transfers on high-value wallets.
Timeline 3
Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.
SourcePeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.
SourceThe Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.
Source
News & write-ups ›2
How this method works
A private key or seed phrase ends up somewhere readable: code on GitHub, an env file, a hacked server or cloud notes. Bots find it within minutes. Read about leaked private keys and seed phrases →
Follow new drains and updates in your feed reader or Telegram RSS bot.