Investigation into how a $7,000 wrong-chain transfer led to an official Safe Factory deployment.
News ·
A $7,000 USDT transfer sent to the wrong blockchain in February 2022 became an unintended entry point for a malicious actor to deploy a factory contract at the same address on Ethereum in June 2022. The actor funded approximately 0.946 ETH from Tornado Cash and used CREATE2 to establish GnosisSafeProxyFactory at a deterministic address matching where the funds had landed, then successfully withdrew the remaining tokens and converted them to ETH by January 2023. Safe later accepted this actor-controlled factory as an official EIP-155 deployment alongside the canonical version, as the bytecode matched expected specifications, creating a situation where the cross-chain address collision arose from the factory's reliance on nonce rather than owner-derived parameters.