The root cause was unrevoked unlimited approvals to an address that was empty on Avalanche. A 2-of-7 Safe had approved WAVAX, USDC, WETH.e and BTC.b spending on 2026-03-07 to 0x3725...6155d, where the team's pool contract exists on Base, Arbitrum and Ethereum but on Avalanche the address was simply Safe's CreateCall 13th deployment, never used. An attacker deployed a sweeper there, but an MEV bot front-ran the transaction, taking 3.09M USDC, 350.4K WAVAX, 182 WETH.e and 10.79 BTC.b. The bot claims to be a whitehat, was offered a 42,500 WAVAX ($371K) bounty, and signers evacuated other-chain Safes holding about $38.7M to a fresh address.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of
Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
4 accounts

first post
Leviathan +2.7 h later

AVAX reaction
i
Price change from the first post to 24 hours later (Hyperliquid). BTC over the same window is shown so a market-wide move is not mistaken for a reaction to this story. Not advice.
−0.4% 24h after post

$8.80 → $8.76
BTC +0.1% same window
Elfa measured −0.6% 1d · still measuring

Thread · 1 event
  1. First reportSafe multisig loses $7.45M on Avalanche after stale token approvals are exploited4 acc.
  2. Leviathan published this article

All times UTC.

Cited posts

  • @DefimonAlerts Defimon AlertsFirst reportOn X ↗

    🚨 Defimon detected an intercepted exploit on a Safe multisig which lost $7.45M due to a misconfiguration on Avalanache. A 2-of-7 Safe holding trading inventory had approved unlimited WAVAX, USDC, WETH.e and BTC.b spending to 0x3725bd4d175283108156c3f15f86e1c51266155d. The… https://t.co/ZZJslO1zeV

3 more accounts posted about this · 3 Telegram channels (no public link)

TradersTrader calls tracked by Elfa · not advice

Positioning · AVAX

Open143 open positions · 137 long · 6 short

Tracked accounts lean long about 97% of the time, so a long-heavy book is normal, not a signal. As of 26 Oct 18:03 UTC.

Whole crypto market, not this story

Crowding0th percentile · vs last 28 days, 50 typical
Pulse 24h46/100 · unusualness of new calls, 0–100, 50 typical, higher means more long than usual
Book97.0% long · 10,748 accounts

As of 27 Oct 11:30 UTC.

Social-monitoring data, not investment advice Elfa prices Hyperliquid post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…