{
 "slug": "whale-safe-1of1-key-compromise-nov-2025",
 "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
 "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
 "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "key-leak",
 "product": "Private whale's Gnosis Safe multisig (Ethereum)",
 "tags": [
  "ethereum",
  "key-leak",
  "gnosis-safe",
  "multisig",
  "private-key-compromise",
  "aave",
  "tornado-cash",
  "whale"
 ],
 "amountUsd": 27300000,
 "victims": 1,
 "startedAt": "2025-11-04",
 "closedAt": "2026-01-06",
 "updatedAt": "2026-01-06T12:00:00Z",
 "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.",
 "timeline": [
  {
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages"
  },
  {
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages"
  },
  {
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Attacker seizes whale multisig, drains $40M in stages",
   "url": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "publisher": "Cointelegraph",
   "date": "2025-12-18"
  },
  {
   "kind": "news",
   "title": "Crypto hacker launders more ETH from compromised multisig as $27M exploit unfolds: PeckShield",
   "url": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "publisher": "The Block",
   "date": "2026-01-06"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nThis was one private wallet. You face the same risk if you hold funds in a Safe or other multisig where one key alone can approve transactions, or if a signer key has ever sat on an internet-connected machine that could be infected.\n\n## What to do now\n- Open your Safe settings and check the owner list and threshold. Any unfamiliar owner, or a threshold of 1, means the wallet is at risk.\n- If you suspect a signer key is exposed, move funds to a new Safe with fresh keys created on hardware wallets.\n\n## How to avoid this\n- Use a real threshold (for example 2-of-3) with each key on a separate hardware wallet held in a different place.\n- Never store seed phrases or private keys as plain text, in screenshots or in cloud backups.\n- Set alerts for owner changes and large outgoing transfers on high-value wallets.",
 "notes": null,
 "agentBrief": "# Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Ethereum · Method: Leaked private keys and seed phrases\n- Started: Nov 4, 2025 · Last update: Jan 6, 2026 · Reported stolen: $27M · Victims: 1\n- Who/what: Private whale's Gnosis Safe multisig (Ethereum)\n\nA private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key.\n\n## Am I affected?\nThis was one private wallet. You face the same risk if you hold funds in a Safe or other multisig where one key alone can approve transactions, or if a signer key has ever sat on an internet-connected machine that could be infected.\n\n## What to do now\n- Open your Safe settings and check the owner list and threshold. Any unfamiliar owner, or a threshold of 1, means the wallet is at risk.\n- If you suspect a signer key is exposed, move funds to a new Safe with fresh keys created on hardware wallets.\n\n## How to avoid this\n- Use a real threshold (for example 2-of-3) with each key on a separate hardware wallet held in a different place.\n- Never store seed phrases or private keys as plain text, in screenshots or in cloud backups.\n- Set alerts for owner changes and large outgoing transfers on high-value wallets.\n\n## Sources\n- Attacker seizes whale multisig, drains $40M in stages (Cointelegraph, 2025-12-18): https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages\n- Crypto hacker launders more ETH from compromised multisig as $27M exploit unfolds: PeckShield (The Block, 2026-01-06): https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield\n\nFull record: https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025 · JSON: https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}