Malicious Multi-Sig Scams¶
A multi-sig wallet needs several signatures to move funds, and that feature can be turned against you. Refuse invitations you did not initiate, and read the full transaction before you sign.
Who this is for¶
Anyone who receives a multi-sig invitation, is added as a co-signer on a wallet they did not create, or is asked to "help approve" a transaction for a project, a treasury, or a person they met online.
How the scam works¶
A Safe-style multi-sig stores a list of owners and a threshold. Changing either one takes a transaction signed by enough existing owners. That is normal administration, and it is also the attack: a proposal can call a function that adds an owner, swaps an owner, lowers the threshold, or enables a module that can move funds without further signatures.
The invitation is the delivery method: a link or a message says you have been added as a co-signer, or asks you to help a "treasury" get started. You open the interface and see a pending transaction with a harmless summary such as "update signers" or "security upgrade". The addresses and the new threshold are one click away, and the summary is not the transaction.
Your signature is not a formality. In an m-of-n wallet, yours may be the last one the attacker needs. A co-signer who approves without reading the parameters completes the trap for everyone else.
The setup can also be inverted. Someone you met online proposes a shared wallet and asks you to name them as an owner, with a threshold low enough that they can act alone. That wallet is theirs from the first deposit.
Before you sign anything, confirm the wallet address, the chain ID (618 on Bitgold mainnet), and each owner address from a source you trust. Then read the function being called and its parameters, not the label above them.
Warning signs¶
- An invitation to a multi-sig you did not ask for, especially from someone you have not met in person.
- The pending transaction adds, removes, or swaps an owner, or changes the threshold.
- The summary says "security update" while the parameters contain an address you do not recognize.
- The other owners are strangers, or the threshold lets one person act alone.
- Someone pressures you to sign now because "the funds are at risk", or asks you to sign outside the official interface.
- You are asked to install an extension or connect to an unfamiliar dashboard before you can see the transaction.
If it happens to you¶
- Do not sign. Open the multi-sig interface by typing its address or domain yourself, confirm the wallet and the chain, and reject the pending transaction.
- If you already signed and the transaction has not executed, ask the other owners you trust to reject it. Do not sign anything else from that interface.
- If it executed, treat the wallet as compromised. Move remaining assets to a wallet you control; a confirmed transaction cannot be reversed.
- Report the invitation on the platform that delivered it, and keep the wallet addresses and transaction hashes for the provider.
Next steps¶
- DApp Approval Scam — the other way a signature grants spending rights.
- Common Fraud Cases — where multi-sig invitations fit in the wider pattern.
- Notes on Using Third-Party DApps — permissions and sessions around the apps you connect.
Self-check¶
- Can you explain what a threshold change does to a multi-sig wallet?
- Would you sign a multi-sig transaction proposed by someone you have not verified offline?
- Do you read owner addresses and the threshold, not only the summary?
- If invited to a multi-sig you did not initiate, do you refuse by default?