{
 "tag": "gnosis-safe",
 "name": "Gnosis Safe",
 "group": "Other",
 "incidents": [
  {
   "slug": "humanity-protocol-dev-machine-keys-jun-2026",
   "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026",
   "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc"
   ],
   "method": "key-leak",
   "product": "Humanity Protocol (H token) bridges and treasury",
   "tags": [
    "ethereum",
    "bsc",
    "key-leak",
    "humanity-protocol",
    "malware",
    "infostealer",
    "developer-machine",
    "gnosis-safe",
    "multisig",
    "bridge",
    "h-token"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-06-15",
   "updatedAt": "2026-06-15T12:00:00Z",
   "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  }
 ],
 "changes": [
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  }
 ]
}