Crypto Whale Loses $38M in Multisig Exploit

by

Crypto Whale Loses $38M in Multisig Exploit

A large cryptocurrency investor lost around $38 million today when someone gained access to their digital wallet and transferred the funds out. The attack happened without immediate public notice.

This case is getting a lot of attention because the hacker didn’t just transfer stolen funds through Tornado Cash – they also kept control of a risky financial position linked to the hacked account.

Multisig Drained After Private Key Compromise

On December 18th, PeckShield, a blockchain security company, reported that a large cryptocurrency holder (known as a whale) lost approximately $27.3 million after their private key was compromised. Further investigation revealed the total losses were closer to $38 million when factoring in connected accounts and investments.

Security firm PeckShield reports that the hacker has already laundered $12.6 million worth of Ether (4,100 ETH) using Tornado Cash to hide the transaction history. Approximately $2 million in stolen funds remains readily accessible. However, the biggest worry is that the attacker still has access to the victim’s account, which currently holds a significant leveraged position on Aave. This account has about $25 million worth of Ether locked as collateral for a $12 million loan in DAI.

A blockchain analyst named Specter outlined what happened: the user set up a special digital wallet called a ‘1-of-1 multisig.’ This wallet only needed one person’s approval to move funds, which actually removed the security benefit of using a multisig wallet in the first place – normally, these wallets require multiple approvals to prevent unauthorized transactions.

Almost immediately after the funds were deposited, the wallet was completely emptied. Simultaneously, control of the wallet was taken over by an attacker.

According to Specter, the most probable cause of the issue is either a leak of the private key during wallet creation or the victim using a compromised service to help set up their wallet. Further research by tanuki42 indicates the attacker might have actually created the multisignature wallet themselves, potentially exposing the victim throughout the setup process and even afterward.

A Familiar Pattern in Crypto Security Failures

As an analyst, I’m seeing this incident as part of a larger, ongoing problem with private key theft and social engineering within the crypto space. Just recently, on December 15th, Security Alliance published a report detailing how hackers, believed to be linked to North Korea, are consistently making fake calls on platforms like Zoom and Teams. They’re using these calls to install malware and ultimately steal private keys, and we’re talking about losses totaling hundreds of millions of dollars as a result.

Back in September, Binance CEO Changpeng Zhao also cautioned that hackers are now more likely to exploit people’s trust than to find weaknesses in computer code. They often do this by pretending to be someone helpful, a job applicant, or an organizer of an event.

Records on the blockchain show this user had been actively building up their Ethereum holdings for months prior to the security breach. On May 7th, Onchain Lens noted that the address had previously taken out over 2,500 ETH from OKX and deposited it with Kiln Finance, consistently increasing their ETH balance.

The attacker still controlling the Aave account creates further risk. Significant market shifts could trigger a cascade of liquidations, increasing the financial damage and highlighting the importance of strong security measures for multi-signature wallets and private keys.

Read More

2025-12-18 22:04