Defimon detected an intercepted exploit on a Safe multisig which lost $7.45M due to a misconfiguration on…: about $7.5M hack on Ethereum
. Reported by public sources (a security firm alert with an address). Amounts are as reported; the trace below shows what the chain says.
On October 27, 2026, according to @DefimonAlerts on X, an exploit against a 2-of-7 Safe multisig holding trading inventory, reported as losing $7.45M, was detected and intercepted. The alert attributed the loss to a misconfiguration on Avalanche, saying the Safe had approved unlimited spending of WAVAX, USDC, WETH.e and BTC.b to address 0x3725bd4d175283108156c3f15f86e1c51266155d, which is named on Ethereum in this entry. KadenaTrace's automatic trace of that address shows no outbound movement and no funds held in traced wallets. The reports do not say where the funds went or whether any were recovered, frozen or returned, and the outcome remains unconfirmed.
Amount: about $7.5M (reported). Networks: Ethereum.
What is known
- Reported
- By @DefimonAlerts.
- Confirmed
- A security firm alert with an address. The amount is as reported.
- Recorded on Kadena
- Not yet.
- Attacker address
- None attributed by a source yet; 1 named in reports is traced but not called the attacker's.
- Exchange deposits
- None seen so far.
- Frozen
- No freeze read on chain.
- Returned
- No return of funds recorded here.
- Trace coverage
- The coverage of this trace was not recorded (traced before Oct 31, 2026); totals are lower bounds until the next refresh.
Sources
- @DefimonAlerts: 🚨 Defimon detected an intercepted exploit on a Safe multisig which lost $7.45M due to a misconfiguration on Avalanache. A 2-of-7 Safe holding trading inventory
Timeline
- Alert from @DefimonAlerts: about $7.5M link
Read: How to trace stolen crypto, hop by hop.
Facts about addresses and transactions, never about people. Trace a wallet · Check an address · All live incidents