🚨 Security update: large-scale address poisoning social engineering campaign targeting multisig users We’ve identified a coordinated effort by malicious actor(s) to create thousands of lookalike Safe addresses designed to trick users into sending funds to the wrong destination. This is social engineering combined with address poisoning. Important: this was not a protocol exploit, not an infrastructure breach, and not a smart contract vulnerability. That said, we take reports like this extremely seriously, because the end result is the same: users’ funds may be at risk. Etherscan reference (attacker factory used to deploy malicious Safes): etherscan.io/address/0x8b770… With the help of SEAL911, Hypernative, and Blockaid, we investigated the attack pattern and identified ~5,000 malicious addresses. These addresses have been flagged as malicious via SafeShield (powered by our security partners) and are being removed from Safe Wallet’s UI, reducing the risk of accidental interaction. Please note: similar schemes are easy for malicious actors to reproduce. It’s therefore critical to follow secure signing procedures, especially for high-value transfers (e.g., verify the full address, use an address book/allowlist, confirm recipients out-of-band, make a smaller transfer first). Address poisoning and social engineering, like phishing, are evolving and persistent threats in crypto. Defending against them requires continuous investment in both detection and UX improvements that reduce human error. For anyone unfamiliar with this attack pattern, we strongly recommend reading more here: help.safe.global/en/articles… Using address book in safe: help.safe.global/en/articles… Using address book in spaces: help.safe.global/en/articles… Stay vigilant: don’t trust—always verify full addresses, not just prefixes and suffixes. 🛡️ Huge thanks to SEAL911, Hypernative, and Blockaid for their rapid support.