{
 "tag": "multisig",
 "name": "Multisig",
 "group": "Other",
 "incidents": [
  {
   "slug": "safe-module-authorization-abuse-rseth-sep-2026",
   "title": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026",
   "json": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": null,
   "product": "A user's Safe multisig with a custom Uniswap v4 liquidity module",
   "tags": [
    "ethereum",
    "safe",
    "multisig",
    "safe-module",
    "uniswap-v4",
    "multicall",
    "rseth",
    "kelp-dao",
    "mev",
    "blockaid"
   ],
   "amountUsd": 7800000,
   "victims": 1,
   "startedAt": "2026-09-15",
   "closedAt": null,
   "updatedAt": "2026-09-15T12:00:00Z",
   "summary": "On 15 September 2026 an attacker abused a custom Uniswap v4 liquidity module and a Multicall helper that an Ethereum Safe multisig owner had approved, pointing the wallet's position at a malicious pool and unwrapping about 2,882 rsETH (around $7.8M). Blockaid described it as abuse of module permissions on that one Safe, not a bug in Safe itself or a stolen owner key. MEV bot Yoink front-ran the attacker and took the funds, Kelp DAO froze that address within about two hours, and whether the funds come back is unresolved. Safe owners should audit every enabled module."
  },
  {
   "slug": "humanity-protocol-dev-machine-keys-jun-2026",
   "title": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026",
   "json": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc"
   ],
   "method": "key-leak",
   "product": "Humanity Protocol (H token) bridges and treasury",
   "tags": [
    "ethereum",
    "bsc",
    "key-leak",
    "humanity-protocol",
    "malware",
    "infostealer",
    "developer-machine",
    "gnosis-safe",
    "multisig",
    "bridge",
    "h-token"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2026-06-08",
   "closedAt": "2026-06-15",
   "updatedAt": "2026-06-15T12:00:00Z",
   "summary": "On 8 June 2026 an attacker used private keys taken from a single malware-infected developer machine to seize Humanity Protocol's admin hot wallet and its Safe multisigs on Ethereum (three of six keys) and BNB Chain (three of five). They drained about 141M H tokens, used malicious bridge upgrades to mint hundreds of millions more and sold them, a loss of more than $36M; H fell about 89% from its high. The team halted bridge deposits and withdrawals and told users not to touch the bridge or liquidity pools."
  },
  {
   "slug": "stablr-1of3-multisig-key-may-2026",
   "title": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026",
   "json": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "StablR EURR and USDR stablecoins and holders",
   "tags": [
    "ethereum",
    "key-leak",
    "stablr",
    "eurr",
    "usdr",
    "stablecoin",
    "multisig",
    "1-of-3",
    "private-key-compromise",
    "depeg"
   ],
   "amountUsd": 2800000,
   "victims": null,
   "startedAt": "2026-05-23",
   "closedAt": "2026-05-24",
   "updatedAt": "2026-05-24T12:00:00Z",
   "summary": "On 23-24 May 2026 an attacker used the compromised private key of one signer on StablR's 1-of-3 minting multisig to add themselves as owner, replace the other owners and mint 8.35M USDR and 4.5M EURR, about $13.5M face value. They dumped about $10.4M of it on DEXs for ETH, with early net proceeds estimated at $2.8M, pushing USDR as low as $0.40 and EURR to about $0.85. ZachXBT said he helped freeze a six-figure sum."
  },
  {
   "slug": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "title": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "json": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-attack",
    "note": "TRM Labs investigator Nick Carlsen, a former FBI analyst, assessed it highly likely that the attackers used AI to pick targets and design the exploit, as The Next Web reported citing Bloomberg; this is an expert assessment, not confirmed."
   },
   "chains": [
    "solana"
   ],
   "method": "durable-nonce",
   "product": "Drift Protocol (Security Council multisig)",
   "tags": [
    "solana",
    "durable-nonce",
    "drift",
    "multisig",
    "security-council",
    "social-engineering",
    "admin-takeover",
    "cctp",
    "wormhole",
    "admin-key",
    "dprk",
    "tornado-cash",
    "laundering",
    "ai"
   ],
   "amountUsd": 285000000,
   "victims": null,
   "startedAt": "2026-04-01",
   "closedAt": "2026-04-01",
   "updatedAt": "2026-10-22T21:53:35.016Z",
   "summary": "On Apr 1, 2026, an attacker took admin control of the Solana perps exchange Drift and drained its vaults of at least $270 million; SlowMist lists $285 million. Weeks earlier, Security Council signers had been led into 'unauthorized or misrepresented' approvals. Because those transactions used durable nonces, they stayed valid until the attacker chose to submit them. The funds were bridged to Ethereum, including more than $230 million in USDC via Circle's CCTP. No code bug was needed. The lesson for teams is that any durable-nonce signing request is high risk."
  },
  {
   "slug": "whale-safe-1of1-key-compromise-nov-2025",
   "title": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025",
   "json": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "key-leak",
   "product": "Private whale's Gnosis Safe multisig (Ethereum)",
   "tags": [
    "ethereum",
    "key-leak",
    "gnosis-safe",
    "multisig",
    "private-key-compromise",
    "aave",
    "tornado-cash",
    "whale"
   ],
   "amountUsd": 27300000,
   "victims": 1,
   "startedAt": "2025-11-04",
   "closedAt": "2026-01-06",
   "updatedAt": "2026-01-06T12:00:00Z",
   "summary": "A private whale's Gnosis Safe on Ethereum, set up so a single signature could approve transactions, was taken over and drained of about $27.3M according to PeckShield; Hacken's forensics say losses may exceed $40M. Ownership passed to the attacker six minutes after the Safe was created on 4 November 2025, and the thief laundered ETH through Tornado Cash in batches while slowly unwinding a leveraged Aave position. A multisig with one signer is only as safe as that one key."
  }
 ],
 "changes": [
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-21",
   "title": "Another 18,800 ETH (about $46M) went to Tornado Cash, a two-day total of 44,510 ETH (about $109M); about 56,569 ETH stayed in exploiter-labelled wallets per Arkham.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-20",
   "title": "The Drift exploiter sent about $61M in ETH to Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/drift-exploiter-moves-109m-eth-tornado-cash-2-days",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "At 04:38 UTC the attacker used the approved module to unwrap the Safe's aEthrsETH into about 2,882 rsETH; Blockaid flagged the theft.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "safe-module-authorization-abuse-rseth-sep-2026",
   "incidentTitle": "Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-09-15",
   "title": "MEV bot Yoink front-ran the exploit by paying the block builder about $46,000, and Kelp DAO froze the receiving address within about two hours.",
   "sourceUrl": "https://unchainedcrypto.com/a-bot-robbed-the-hacker-who-drained-7-8-million-in-rseth-from-a-safe-wallet/",
   "url": "https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-15",
   "title": "Halborn's analysis said malware with root access on a developer computer collected seven keys left there by an accidental backup at mainnet launch; ZachXBT questioned that explanation.",
   "sourceUrl": "https://www.halborn.com/blog/post/explained-the-humanity-protocol-hack-june-2026",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-09",
   "title": "Founder Terence Kwok confirmed the incident; the team halted deposits and withdrawals on the affected bridges as H fell from $0.731 to $0.0796.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "humanity-protocol-dev-machine-keys-jun-2026",
   "incidentTitle": "Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-06-08",
   "title": "Attackers used stolen keys to take over Safe multisigs on Ethereum (3 of 6) and BSC (3 of 5), gained ProxyAdmin control and drained about 141.2M H.",
   "sourceUrl": "https://decrypt.co/370485/humanity-protocol-loses-36m-after-private-keys-compromised-token-crashes-73",
   "url": "https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-24",
   "title": "StablR acknowledged an exploit on X about eight hours after on-chain activity stopped; Blockaid attributed it to one signer's compromised key on a 1-of-3 multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "stablr-1of3-multisig-key-may-2026",
   "incidentTitle": "StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "partly-contained",
   "date": "2026-05-23",
   "title": "ZachXBT flagged the exploit at 9:46 PM ET after the attacker minted 8.35M USDR and 4.5M EURR through the minting multisig.",
   "sourceUrl": "https://theblock.co/post/402429/stablrs-eurr-and-usdr-depeg-after-attacker-mints-13-5-million-in-unbacked-tokens-through-multisig-exploit",
   "url": "https://drains.watch/i/stablr-1of3-multisig-key-may-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-03",
   "title": "SecurityWeek reported Elliptic's $286M estimate and a likely North Korean link; about $225M had been swapped to Ethereum.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "About a minute after a legitimate insurance-fund test withdrawal, the attacker submitted two pre-signed transactions, took admin control and drained the vaults.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-04-01",
   "title": "Attackers executed pre-signed durable-nonce transactions to take Drift's admin key, created a fake CVT collateral market, raised the circuit breaker and drained six assets in about 10 seconds.",
   "sourceUrl": "https://www.securityweek.com/north-korean-hackers-drain-285-million-from-drift-in-10-seconds/",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-30",
   "title": "A new durable nonce account tied to a member of the updated multisig appeared.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-27",
   "title": "Drift executed a planned Security Council migration to replace a member.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "drift-protocol-durable-nonce-admin-takeover-apr-2026",
   "incidentTitle": "Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-03-23",
   "title": "Four durable nonce accounts were created, two tied to Security Council members and two controlled by the attacker.",
   "sourceUrl": "https://www.coindesk.com/tech/2026/04/02/how-a-solana-feature-designed-for-convenience-let-an-attacker-drain-usd270-million-from-drift",
   "url": "https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-06",
   "title": "Laundering continued: about 6,300 ETH had been routed through Tornado Cash while the attacker withdrew collateral from a leveraged Aave position in stages.",
   "sourceUrl": "https://www.theblock.co/post/384441/crypto-hacker-launders-more-eth-from-compromised-multisig-as-27m-exploit-unfolds-peckshield",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-18",
   "title": "PeckShield reported about $27.3M drained via a private key compromise, with about 4,100 ETH already sent through Tornado Cash.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  },
  {
   "incident": "whale-safe-1of1-key-compromise-nov-2025",
   "incidentTitle": "Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-11-04",
   "title": "The Safe was created at 07:46 UTC and ownership passed to the attacker six minutes later; a first 1,000 ETH went to Tornado Cash that day, per Hacken.",
   "sourceUrl": "https://cointelegraph.com/news/attacker-seizes-whale-multisig-drains-40m-in-stages",
   "url": "https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025"
  }
 ]
}