What happened
On March 16, 2024, several Remilia wallets, including its multisig, were compromised. Remilia later described access centralization on the CEO's devices, likely involving malware, while CertiK reported the project's belief that a Bitwarden-account compromise may have exposed multiple wallet keys. ETH and REMIO/MILADY NFTs were taken; CertiK later tracked 844.8 ETH in NFT-sale proceeds split from one exploit wallet.
How it happened
- Several wallets associated with Remilia, including the multisig, were compromised; Remilia later described centralized wallet access on the CEO's devices as the root vulnerability.
- CertiK reported that the project considered compromise of its Bitwarden account a likely source of access to multiple wallets.
- The attacker had the private keys for all four multisig signers.
- Raising the multisig threshold from three-of-four to four-of-four therefore did not prevent the attacker from draining it.
Protocol details
Classification
Other / Key Compromise
Protocol Type
Exploit/Access control
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
