Ethereum Whale’s Wallet Drained of $27 Million After Private Key Leak

TLDR

• A private key hack caused a $27 million loss from an Ethereum whale’s wallet.
• Ethereum, WETH, OKB, and FET tokens were among those drained by the attacker.
• The compromised multisig wallet used a flawed “1-of-1” signature setup.
• The attacker laundered funds through Tornado Cash in staggered transactions.

A recent hack has drained over $27 million from an Ethereum whale’s multisig wallet, caused by a private key compromise. The wallet’s private key was allegedly leaked or stolen, allowing the attacker to access and control the funds. The attacker has been able to launder some of the stolen assets using Tornado Cash, a tool known for anonymizing cryptocurrency transactions. This incident has raised concerns about the security of multisig wallets and private key management.

Multisig Wallet Compromised

The attack was first noticed by blockchain security firm PeckShield, which reported that the victim’s multisig wallet was compromised shortly after it was created. The hacker managed to take control of the wallet just six minutes after its creation on November 4, 2025. At this point, ownership of the wallet was transferred from the victim to the attacker.

The wallet, initially set up with multisig security, was later discovered to have been configured as a “1-of-1” wallet. This setup allowed a single signature to approve transactions, making it vulnerable to attack. Experts argue that this flaw essentially defeated the purpose of a multisig setup, which typically requires multiple signatures for transaction approval.

Funds Laundered Through Tornado Cash

Once the attacker gained control, they started moving the stolen funds in batches, using Tornado Cash to launder the assets. PeckShield reports that approximately $12.6 million, or around 4,100 ETH, was sent through Tornado Cash. This technique helps obfuscate the origin of the funds, making it more difficult for authorities or blockchain analysts to trace the stolen assets.

In addition to the 4,100 ETH, the attacker also held a portion of the funds in liquid assets, including $2 million in stablecoins and tokens. These tokens included ETH, WETH (Wrapped Ethereum), OKB, LEO, and FET, which were among the assets drained from the wallet. The total value of the stolen assets could be as high as $40 million, based on new findings from forensic experts.

Leveraged Position at Risk

At the time of the hack, the victim’s wallet had a significant leveraged position on the decentralized lending platform Aave. The victim had supplied about $25 million worth of Ethereum, borrowing roughly $12.3 million in DAI against it.

However, with the wallet compromised, the attacker could potentially liquidate these assets if the Ethereum price drops significantly. The current health factor of the leveraged position is around 1.68, meaning it is close to being liquidated if Ethereum’s price declines further.

This situation poses a risk not only to the victim but also to the broader market, as forced liquidations could create selling pressure on Ethereum and other assets involved in the attack.

Security Vulnerabilities in Multisig Setup

Experts have pointed to several potential vulnerabilities in the way the victim handled their multisig wallet. Malware or phishing attacks targeting the victim’s device or poor security practices might have led to the private key compromise. To prevent such attacks, security professionals recommend using isolated, offline signing devices and verifying transactions beyond the user interface.

Furthermore, the fact that the wallet was configured as a “1-of-1” raises questions about the victim’s operational security. A multisig wallet ideally requires multiple signatures from different participants, reducing the risk of a single point of failure.

The post Ethereum Whale’s Wallet Drained of $27 Million After Private Key Leak appeared first on CoinCentral.