The main treasury of
@Commons Hub Brussels has been drained yesterday. We lost €110k (
https://txinfo.xyz/gnosis/tx/0x89387e323934fc5b498c5e12714dc4a372be60781ef06f2800ffb138709bfbe4)
Already reached out to Monerium, gnosis team, etc. but there is nothing we can do to recover the funds 😢
What happened:
One of our signatories had for historic reasons two keys to make any payment from the multisig of our Monerium account. He has been a victim of a supply chain attack (PolinRider) earlier this month. We first thought that only environment variables were at risk, not his private keys. But apparently the attacker installed a keylogger and retrieved the encryption key of his metamask.
Mistake 1: those two keys belong to the same person and should have been on two different devices. They somehow ended up in the same metamask on his main computer (we were unaware)
Mistake 2: that person actually left the organization months ago and we should have removed his keys from the SAFE. That’s my negligence. It’s not enough to set up a multisig, it needs constant tending.
Very expensive lesson. How was your Monday?
