Crypto Hack Alert: Poor Multisig Setup Lead $27.3M ETH Laundering Case

Crypto Hack Highlights: PeckShield Flags $27.3M Multisig Wallet Breach

Highlights

• A hacker laundered $27.3M via Tornado Cash after exploiting a poorly configured multisig wallet

• 6,300 ETH deposited into Tornado Cash; 1,000 ETH withdrawn from Aave recently.

• A hacker laundered $27.3 million on Tornado Cash after breaking into a loosely secured multisig wallet.

Multisig Crypto Hack of December Reemerges

In a Recent Development, blockchain security company PeckShieldAlert has reported new activity associated with a crypto hack in December 2025, in which a hacked multisig wallet resulted in losses of up to $27.3 million. The attacker has been laundering money on DeFi platforms, which have brought about new concerns about wallet security and on-chain risks.

Major Multisig Wallet Breach Resurfaces.

As confirmed, the hack was a result of a private key compromise with a 1-of-1 multisig wallet, which was poorly configured, and which, in effect, neutralizes the security of multi-signatures. The hack was first announced last month, but it has since reappeared with new on-chain transactions.

According to blockchain researchers, the attacker is now active once again, moving and laundering stolen funds using decentralized finance (DeFi) protocols.

Source: Peckshield X

Funds Moved From Aave to Tornado Cash

On-chain tracking in recent times indicates that the hacker took out 1,000 ETH, worth approximately $3.24 million, out of the Aave lending protocol. The stolen money was soon sent to Tornado Cash, a privacy-oriented crypto mixer that is popular for hiding a transaction history.

The total amount of ETH deposited by the attacker to Tornado Cash is 6,300, which is approximately worth $19.4 million. According to PeckShield data, these deposits were done in recurring batches, frequently in 100 ETH blocks, a standard method of minimizing traceability and maximizing anonymity.

Attacker Maintains Leveraged ETH Position

The hacker is still actively engaged in DeFi trading, even though he laundered a large part of the stolen funds. According to PeckShield, the attacker now has a leveraged Ethereum long position of $9.75M.

The attacker has provided 6.34 wrapped ETH (wETH) worth about $20.5M on Aave, and borrowed $10.7 million DAI. The health factor of the position is 1.58%, which implies that it is stable at present but may be liquidated in case the Ethereum price falls significantly.

This continuous exposure indicates that the attacker is hoping that Ethereum will rise further, despite laundering stolen money.

Security Issues With “Fake” Multisig Wallets

The event again points to the dangers of inappropriate settings, especially the 1-of-1 ones, which offer minimal actual security. The experts caution that such wallets give users a false perception of security and that the high-valued assets are prone to single-key failures.

December 2025 Crypto Losses Still Matter

In December 2025, the total number of crypto-related losses amounted to $76 million, or 60 times less than in November. Although the losses have reduced, this instance indicates that wallet misconfigurations and DeFi exploits are still persistent.

Conclusion

The event highlights the ongoing DeFi security vulnerability, abuse of privacy technologies, and the risks of ineffective construction, and it is necessary to have more powerful settings and better risk management.

Disclosure: This is not financial advice. Do your own research before investing. CoinGabbar is not responsible for financial losses. Cryptocurrencies are highly volatile and may result in total loss of capital.