multi-signature

According to Onchain Lens monitoring, less than an hour ago, a certain whale withdrew 28,000 HYPE from HTX, worth approximately 2.57 million dollars, and transferred it to a multi-signature wallet.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

According to on-chain analyst Ai Yi's monitoring, the multi-signature associated address of WLD (Worldcoin) has deposited 42.37 million WLD to Binance in the past 8 hours, worth approximately 19.59 million USD.This is the first time this address has deposited to the exchange in 5 months, and after this deposit, the address has fully liquidated its holdings.

According to on-chain analyst Yu Jin's monitoring, a multi-signature wallet of WLFI transferred 88 million WLFI (approximately 5.09 million USD) to Binance half an hour ago.In the past month, this address has gradually transferred 248 million WLFI (approximately 13.55 million USD) to Binance.

According to Blockaid monitoring, an attack was discovered on an unidentified user's Safe multi-signature wallet on Ethereum. The attacker introduced a custom Uni V4 LP Safe module into a liquidity pool they created through a public keeper multicall, and then the hook unpacked aEthrsETH into rsETH, completing the extraction of Yoink MEV within the block. Currently, two transactions have been confirmed to cause approximately 7.73 million dollars in rsETH losses.

Multi-signature wallet Safe announced that it will launch Safe Pro on October 6. Teams can now apply to become early partners to help shape the product.Safe Pro offers enterprise-level management, additional security features, audit history, and reporting capabilities for all Safe accounts operated by the organization, along with guided onboarding and professional support, while self-custody remains unchanged.Before the launch, Safe has opened the Safe Pro early partner program to teams that wish to collaborate directly. The application link can be found in their official post.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

According to Onchain Lens monitoring, a wallet transferred 289,760 LINK (approximately 2.74 million USD) into its Gnosis Safe multi-signature wallet. These tokens were accumulated from Binance over the past month.

Bitgo CEO Mike Belshe deposited 100 BTC into a public Bitcoin address, valued at approximately $6.3 million at the time, and invited the Claude model under Anthropic to attempt to transfer the funds from that address. On-chain records show that the wallet received the funds on July 31, and the balance has not been transferred out.Anthropic previously disclosed that during 141,006 cybersecurity assessment runs, 3 incidents were found, with 6 assessment sessions involving 3 models unexpectedly interacting with real organizational systems. The relevant models include Claude Opus 4.7, Claude Mythos 5, and an unpublished internal research model, due to configuration errors by third-party testing partner Irregular that caused the testing environment to connect to the internet.Anthropic stated that Claude Opus 4.7 identified a real website sharing the same name as a simulated company during one assessment, exploited weak passwords and exposed services to recover infrastructure credentials, and accessed a production database containing hundreds of records. The company claimed that the model was attempting to complete assigned tasks and was not actively breaking restrictions or pursuing independent goals. Belshe's challenge involved the Bitgo institutional custody platform, which uses multi-signature or multi-party computation technology to distribute signing authority across multiple independent keys. Anthropic has not publicly responded to this challenge.

According to Onchain Lens monitoring, a certain whale has accumulated 266,400 LINK from Binance over the past month, worth approximately 2.15 million USD, and then transferred the entire balance to a Gnosis Safe multi-signature wallet.

According to monitoring by PeckShield, the attacker’s marked address has returned 331.8 ETH, approximately 623,900 USD, to the Across Protocol Hub Pool Owner multi-signature address.

According to on-chain analyst @ai_9684xtpa, the Worldcoin multi-signature address transferred a value of $13.84 million in WLD to two new addresses 9 hours ago.The upstream address actually received 60 million WLD, and this time only transferred out 36.94 million WLD; the receiving addresses have not yet transferred or sold.

According to Onchain Lens monitoring, a certain Chainlink whale transferred 431,000 LINK to a Gnosis Safe multi-signature wallet, valued at approximately 3.76 million dollars.This whale had previously accumulated and withdrawn these tokens from Binance into two wallets through multiple transactions over the past three weeks, with the final two transfers being 176,029 LINK, valued at approximately 1.53 million dollars, and 255,468 LINK, valued at approximately 2.23 million dollars.

According to official news, the ENS DAO has approved the proposal to activate a new security committee, with a term of two years. The committee consists of eight members and has veto power, allowing it to cancel proposals during the waiting period after malicious proposals are passed but before execution. The committee's authority is limited to canceling transactions within the time lock and cannot access treasury funds, submit proposals, or rewrite approved proposals.The committee can only exercise its power under emergency conditions specified in its charter. ENS points out that governance itself may become an attack surface—voting rights can be borrowed to initiate attacks, proposal codes can hide malicious behavior, and credential leaks can be used to push harmful transactions. The new committee adopts a 5-of-8 multi-signature, requiring at least five members' agreement to cancel a proposal, and must seek DAO voting for extension after the two-year term.

According to on-chain analysts, the Ondo team’s multi-signature wallet transferred 150 million ONDO to address 0xEA5...675e1 8 hours ago, worth 49.56 million USD.Since April 22, this address has received a total of 425 million ONDO (147 million USD), and the previous two batches of received tokens were deposited into Coinbase in parts, with the purpose unknown.

Layer 1 blockchain Tempo proposed TIP-1061, a native multi-signature account proposal, aiming to introduce multi-signature as a native account type at the protocol layer, allowing multi-signature control without the need to deploy smart contract wallets like Safe.This solution supports M/N multi-signature, weighted multi-signature, as well as Secp256k1, P256, and WebAuthn signatures, and allows for subsequent adjustments of members and permissions while keeping the account address unchanged. This proposal is primarily aimed at scenarios involving DAOs, institutions, and validators, and is currently still in the draft stage.

SUPERFORTUNE AI posted on platform X that the team is investigating the GUA security incident that occurred on May 27. This incident caused severe fluctuations in token prices, and preliminary investigations indicate that the incident may involve address tampering in a multi-signature transaction.The announcement stated that the plan was to send additional unlocked tokens to the airdrop claim contract address, but during the execution of the transaction, the funds were mistakenly sent to another hacker address. The team noted that this hacker address had never interacted with any addresses related to SUPERFORTUNE before, so the likelihood of an "address poisoning attack" as a method of attack is low. Additionally, SUPERFORTUNE stated that its internal processes already include a multi-address verification mechanism, and the team is still continuing to investigate the incident and will update the community on the latest developments.

According to GoPlus analysis, the stablecoin protocol StablR had security issues with its multi-signature contract settings on Ethereum (multi-signature threshold of 1), and the holder's private key was stolen, resulting in StablR $EURR and $USDR stablecoins being depegged by 20%. The attacker has profited approximately $2.8 million.

LayerZero Labs posted on the X platform that the internal RPC used by LayerZero Labs was attacked by the Lazarus Group in the past three weeks, resulting in the compromise of the true source of its DVN (Decentralized Verification Network), while external RPC providers faced DDOS attacks. This incident affected 0.14% of applications and approximately 0.36% of asset value.LayerZero Labs stated that asset security is currently intact, and since April 19, over $9 billion in funds have been completed across chains through the protocol. In response to security risks, LayerZero Labs has stopped providing services for its DVN in a 1/1 configuration, and all default configurations for channels will be migrated to at least a 3/3 or 5/5 multi-DVN mode.Additionally, in response to an incident three years ago where multi-signature holders mistakenly used hardware wallets for personal transactions, LayerZero Labs has removed that signer and changed wallets, while also developing a OneSig custom multi-signature system. LayerZero Labs recommends that developers lock configurations to avoid relying on default settings and plans to launch an asset management platform Console to enhance security monitoring.

A certain crypto KOL posted on platform X that the address ranked first on the Bitcoin billionaire list is a Binance-related address, which is a wallet address starting with "3" and holds over 200,000 BTC. He questioned the security of Binance storing such a large amount of Bitcoin in a single address and expressed concerns about the risk of private key collision cracking. In response, CZ stated, "The one starting with 3 should be a multi-signature, right? You would need to collide more than 3 private keys? Trust the math."Analysis suggests that this address is highly likely using a multi-signature mechanism. Even if there is a theoretical possibility of private key collision, the actual difficulty of cracking it is extremely high.