A sophisticated phishing attack has resulted in a $3 million loss from a multi-signature wallet, highlighting evolving security threats in the crypto space. The attacker used a carefully crafted malicious contract that mimicked legitimate transactions. Blockchain investigators traced the stolen funds through Ethereum swaps into privacy mixer Tornado Cash.
- Attackers used an Etherscan-verified fake contract deployed two weeks in advance with multiple batch payment functions to appear legitimate
- The exploit specifically targeted the Safe Multi Send mechanism, disguising abnormal approvals within routine transaction authorizations
- Security experts warn that similar attacks could originate from app vulnerabilities, compromised front-ends, malware, or DNS hijacking
📎 Related coverage from: cryptoslate.com
