Attacker exploited CREATE-based address generation to claim $7K USDT sent to wrong chain by reproducing a Safe factory's exact nonce sequence.
Security & Exploits ·
A $7,000 USDT transfer sent to an address on the wrong blockchain was claimed by an attacker who reconstructed the exact conditions under which a Safe factory contract had been deployed. The recipient address existed as a functioning Safe proxy on Avalanche starting in December 2021, but on Ethereum the same address remained unused until months later. In February 2022, USDT arrived at that Ethereum address, where no contract yet existed to receive or control it.
The attacker exploited how CREATE-based address generation works within Safe's factory system. Unlike CREATE2, which incorporates owner details into the address derivation, CREATE produces addresses based solely on the deployer contract and its nonce counter. By standing up a factory at the same address used on Avalanche and matching that factory's nonce sequence, the attacker could call the createProxy method to instantiate a new Safe at the target address—one owned by the attacker themselves—and gain control of the tokens that had been sitting there.
The same factory address later became officially adopted by Safe and incorporated into the project's canonical deployment registry, treated as the expected EIP-155 variant of GnosisSafeProxyFactory v1.3.0 on Ethereum. It remains unclear whether Safe was aware of the address's origin when it was added to the official list, or how many other similar incidents may have occurred across other chains and token transfers.