SlowMist Cosine: A user suspected of losing $27 million in crypto assets due to private key leakage caused by computer malware

According to ChainCatcher, SlowMist’s Cosine posted on X that user Babur suffered a theft of crypto assets worth $27 million. Analysis shows that the stolen assets mainly involve two addresses: Solana address 91xu and Ethereum Safe multi-signature address 0xD2, with the two largest stolen assets totaling over $18 million.

The hacker addresses are 71fM (Solana) and 0x4f (Ethereum), and part of the funds have already been bridged to the Ethereum network. The incident is suspected to have been caused by malware on the victim’s computer; after the user double-clicked and ran a malicious file, the private keys were leaked, including two signature private keys for the Safe multi-signature, which may have been stored on the infected computer.