# Multisig · Drain Watch

5 incidents, 2 live. JSON: https://drains.watch/t/multisig.json · RSS: https://drains.watch/t/multisig/feed.xml

- [Over-permissioned Safe module abused to drain about $7.8M in rsETH; MEV bot front-runs the thief](https://drains.watch/i/safe-module-authorization-abuse-rseth-sep-2026) (live, Critical, Partly contained, since Sep 15, 2026)
- [Humanity Protocol loses $36M after malware on one developer machine exposes hot-wallet and Safe keys](https://drains.watch/i/humanity-protocol-dev-machine-keys-jun-2026) (closed, Critical, Partly contained, since Jun 8, 2026)
- [StablR's EURR and USDR depeg after attacker takes over 1-of-3 minting multisig with a stolen key](https://drains.watch/i/stablr-1of3-multisig-key-may-2026) (closed, Critical, Partly contained, since May 23, 2026)
- [Drift Protocol drained of $270M+ after signers pre-signed durable-nonce admin transactions](https://drains.watch/i/drift-protocol-durable-nonce-admin-takeover-apr-2026) (live, Critical, Contained, since Apr 1, 2026)
- [Whale's 1-of-1 Safe multisig drained of $27M+ after key compromise, ETH laundered via Tornado Cash](https://drains.watch/i/whale-safe-1of1-key-compromise-nov-2025) (closed, Critical, Still active, since Nov 4, 2025)