Attempted $7.45M drain of an Avalanche Safe multisig via a stale token approval (2026-10-26): front-run by an MEV bot, funds returned minus a bounty
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Safe multisig on Avalanche holding trading inventory (operator not named)
- Incident date: 2026-10-26
- Reported: 2026-10-27
- Last updated: 2026-10-27
On 2026-10-26 an attacker tried to drain about $7.45M from a 2-of-7 Safe multisig on Avalanche by deploying a contract at an address the Safe had approved to spend its tokens, according to Defimon. An MEV bot copied and front-ran the attack in the same block, so the attacker's transaction failed. The bot, which says it is a whitehat, returned the funds on 2026-10-27 minus a 42,500 WAVAX bounty that was agreed in an on-chain message. This report lists the attacker's wallet. What happened: per Defimon, in a batch on 2026-03-07 the Safe approved unlimited WAVAX, USDC, WETH.e and BTC.b spending…