Multisig Wallet Theft Claims $7.4M Lost in Social Engineering Scam

A multisig wallet suffered a $7.4M theft after two of seven approvals were forged via social engineering, draining ETH, BTC and USDT. The attacker exploited a human-centric weakness, not a software bug, and moved the funds in a single outbound transaction.

How the breach unfolded

The victim’s multisig arrangement required seven signatures to move funds. Two signatures were submitted by an attacker who had obtained access to the victim’s private keys through a social engineering campaign. Once those two approvals were recorded, the attacker could trigger withdrawals for all three supported assets. The transaction chain shows a single outbound transfer of approximately $7M, split across the three currencies.

Immediate impact on the victim

The victim’s balance fell from roughly $7.4M to zero in a matter of minutes. The loss includes about $4.5M in ETH, $2.3M in BTC and $800k in USDT, based on the exchange rates at the time of the transfer. The wallet owner has not yet issued a public statement, but the Telegram post indicates that the user is investigating the breach and has notified relevant custodial services.

What this means for multisig users

Multisig wallets are often promoted as a safeguard against single-point failures. This case demonstrates that the security model collapses if an attacker can coerce or compromise even a minority of the required signatures. Users must verify every approval request, especially when the request originates from an unfamiliar device or network.

Why social engineering remains a threat

The attacker’s method relied on tricking the victim into signing transactions. No exploit of the wallet software itself was reported; the breach was purely human-centric. This aligns with recent trends where attackers target high-value holders through phishing, pretexting, or credential stuffing.

Steps for affected users

  1. Audit all pending approvals – Check the multisig transaction history for any unauthorized requests.
  2. Revoke compromised keys – If a private key has been exposed, replace it immediately and update the multisig threshold if necessary.
  3. Enable multi-factor authentication – Add an extra layer of verification for approval requests.
  4. Notify exchanges and custodians – Inform any third-party services that may hold or manage the assets.
  5. Report the incident – File a complaint with local law enforcement and relevant regulatory bodies.

Broader implications for the crypto ecosystem

The incident adds to a growing list of high-value thefts that exploit human factors rather than software bugs. It highlights the need for better user education around multisig operations and the importance of secure key management practices.

Similar attacks have surfaced recently, such as the $2.7M address-poisoning scam and the $947K Bloom wallet exploit. These cases share a common thread: attackers leverage social engineering to bypass technical safeguards.

What to watch next

Regulators are tightening rules around key management for high-risk wallets. Industry groups are developing best-practice guidelines for multisig deployments. Users should stay alert for updates on these frameworks and adjust their security posture accordingly.

Final note

The available evidence does not show whether the attacker will attempt further withdrawals from other wallets or if the breach was an isolated incident. Users should remain vigilant and verify every multisig approval to prevent similar losses.

Explore more on this topic