The Brief
A newly minted multisignature wallet, intended to be a fortress for institutional-grade capital, was compromised minutes after its creation today, leaking approximately $27.3 million in Ethereum (ETH) and stablecoins. PeckShield and other blockchain investigators confirmed the attack is ongoing, with the perpetrator conducting a “slow bleed” of assets rather than a single flash-loan style extraction.
The total potential loss is estimated at $40 million, as the compromised entity still holds a massive leveraged position on the lending protocol Aave.
The Mechanics
This was not a smart contract exploit or a protocol failure. The vector was operational: a compromised private key. Despite the wallet being a multisig (requiring multiple keys to authorize transactions), the speed of the breach, occurring almost immediately after the wallet was funded, suggests a severe lapse in key generation or custody procedures.
The Flow of Funds:
- Total Drained: ~$27.3 million so far.
- Laundering: The attacker has already moved approximately $12.6 million (roughly 4,100 ETH) through the privacy mixer Tornado Cash in sequential batches.
- Remaining: Roughly $2 million in liquid assets remains in the wallet, with the rest locked in DeFi positions.
The Aave Contagion Risk
The immediate market concern extends beyond the stolen ETH. The compromised wallet holds a high-risk leveraged long position on Aave:
- Collateral: $25 million in ETH.
- Debt: $12.3 million in DAI.
If the attacker attempts to unwind this position clumsily, or if the theft triggers a liquidation cascade, it could force a $25 million sell-wall onto the spot market. On-chain analysts are monitoring the Aave health factor closely, as a liquidation event would likely create localized volatility for ETH pairs.
“The sector’s biggest vulnerability is not technical complexity but willful negligence. Crypto is facing a security reckoning.” . Mitchell Amador, CEO of Immunefi
Market Reaction
Ethereum (ETH) is currently trading near $3,075, showing resilience despite the selling pressure from the hack. However, the incident has reignited fears regarding “blind signing” and private key management for high-net-worth holders. The slow nature of the drain indicates the attacker is methodically bypassing liquidity constraints to maximize the extraction value.
