If you used multipli.fi on October 9–10, your wallet may have been drained.

The Multiplifi yield protocol's official website was compromised and served a compromised frontend. The fake "connect wallet / login" popup asked users to sign — and the signature was an unlimited token approval that let a drainer contract empty their wallets. This is an independent, community-maintained resource for affected users. This is not legal advice.

The incident is on BSC. Always verify contract and site addresses yourself — never trust a link someone sends you, including this page.

Check your address

Paste the BSC wallet address you used on the Multiplifi site. This runs entirely in your browser against a hash index of chain-verified drain victims — your address never leaves this page.

What happened

reported On October 9–10, 2026, the official multipli.fi website — linked from the protocol's own verified @multiplifi X account — began serving a compromised frontend. When users clicked "connect wallet," the page presented what looked like a routine login signature. The signature was actually a request for an unlimited token approval to a drainer contract.

documented On-chain, the mechanism is a classic approval-phishing drainer: victim approves spender 0x3b2c3fdf… → an operator address (0x3ef438c3…) calls an exec function → the victim's tokens are swept to collector addresses in the same transaction. The user saw a blank or frozen site and no confirmation of what they signed.

reported The protocol acknowledged "suspicious activity" only on a founder's personal account; the official @multiplifi handle did not prominently warn users during the drain window — a gap victims cite as the reason they signed.

The one rule: no legitimate party — Multiplifi, a wallet vendor, police, a lawyer, this site, or anyone claiming to be any of those — will ever need your recovery phrase, private key, or a "verification signature." Anyone who asks is stealing from you. This intake form is hardened to reject seed-shaped text before it is even sealed.

What the evidence shows

Each item is tagged: documented = preserved primary/on-chain evidence · reported = community or press statements, not independently verified · open = unresolved question.

documented A serial drainer infrastructure, still active. The drainer contract 0x3b2c3fdfadef5237f2d05e61949a56c5a80b2f0d and operator 0x3ef438c34ce51a697a24247fe033c4562c94f0fd feed two collector addresses. The shared collector has taken 230 drain events from 164 unique wallets since September 25 — this operation serves multiple campaigns, not just Multiplifi.

documented Incident-window census: 27 unique senders drained Oct 9–14. Within the compromise window, the collectors received 41 inbound transfers from 27 wallets — including xUSDT (Multiplifi's own yield token), USDT, USDC, and assorted tokens, a typical "sweep everything approved" profile. See the census data.

documented The first documented victim lost ~2,013 xUSDT. A self-reported victim linked their approval and drain transactions on BscScan: they signed the fake login on Oct 10, and ~2,013 xUSDT was redeemed out of their wallet the same day, split across both collector addresses.

reported The compromised window may span more than Oct 9–10. The site was reportedly unresponsive for several days around the incident. Users who visited any time from Oct 9 onward and signed anything should treat those approvals as suspect.

open Attribution is unresolved. The topology matches documented registrar/DNS-hijack drainer campaigns, but no confirmed attribution exists. The project's own investigation and any law-enforcement referral are pending.

Do this right now

1. Revoke the approval — before anything else

If you connected a wallet to multipli.fi during the window and signed anything, revoke the approval immediately: revoke.cash or BscScan's token-approval checker — search your address, find approvals to 0x3b2c3fdfadef5237f2d05e61949a56c5a80b2f0d, revoke them. A signature already used can't be unsigned, but any un-drained approved balance is still at risk until revoked.

2. If you were drained — preserve the evidence

Don't panic-delete anything. Your BscScan transaction history, wallet signature prompts, browser history, and Discord/Telegram messages with support are all evidence. Photograph or export them now — see evidence + reporting.

3. Move remaining funds to a fresh wallet

If the same wallet holds other approved tokens or assets, move them to a new wallet with a clean seed — generated on a clean device — before reconnecting it anywhere.

4. Expect the second scam

Drainer victims get re-targeted. Fake "Multiplifi support," fake "refund" and "recovery agent" DMs, and fake victim-intake sites typically follow every public incident — some styled to look exactly like pages like this one. Read the anti-phishing page before responding to anyone.

Submit a sealed incident report

This site runs a sealed intake: your report is encrypted in your browser to keys held off this infrastructure before it is sent. The server stores ciphertext only — even the site operators cannot read it until you choose to release it to counsel you designate or a claimant committee. You can retrieve or delete your submission at any time from the manage page.

Submit a sealed report — what you lost, which tokens, how you were connected. Takes ~5 minutes.
Check your record — confirm a receipt.
Verify a proof — submission inclusion proofs and self-decryption, fully in-browser.
Victim report tracker — opt-in public tally, non-identifying fields only.
Census data — the chain-derived drain census, all provenance-labeled.

Before you submit anywhere: this site will never ask for your recovery phrase, private key, a signature, remote access to your computer, or a "verification fee." The intake form rejects seed-shaped text before sealing. Any site, DM, or call that asks for those is a scam — including ones impersonating this project.

FAQ

I used multipli.fi before Oct 9 — am I affected?
open The confirmed compromise window is Oct 9–10, but the site was unstable in the days around it. If you signed anything in early October, check your approvals — the drain checker above covers the chain-verified census, and revoke.cash covers live approvals.

I connected but didn't sign / didn't approve — am I safe?
Connecting alone only exposes your address. If you never approved a transaction, your funds should be intact — but check approvals anyway, and watch your wallet for a few days.

Will I get my funds back?
Unknown. Recovery depends on whether the funds reach a cooperative exchange (the collectors feed into real CEX deposit addresses — a documented path for freezes) and on coordinated victim reports, issuer freezes, and law enforcement. Filing reports even for small losses materially helps — see reporting.

Is this site run by Multiplifi?
No — and distrust any site that claims vendor affiliation you cannot independently verify on the vendor's own domain. This is an independent claimant-coordination resource; see privacy and the counsel page for how submissions are governed.

Where this comes from — and corrections

This site aggregates on-chain records (BSC transfers to the identified collector addresses, reproducible from raw chain data), the protocol's own public posts, and victim statements. Items are labeled documented / reported / open. Reported items are community or press statements we could not independently verify. Nothing here asserts wrongdoing by the Multiplifi team — the drainer infrastructure documented here is third-party; how the frontend came to serve it (DNS hijack, registrar compromise, code injection, or otherwise) is an open question, and whether any party bears legal responsibility is for the relevant courts and investigators.

Corrections. If you represent Multiplifi, its security researchers, or affected infrastructure and believe a statement here is inaccurate, contact the maintainers at terexmaps@gmail.com with supporting evidence — verified corrections are incorporated. Claims that primary evidence does not yet support are labeled "reported" or omitted entirely.