Independent public-interest resource — not affiliated with Multiplifi or any wallet provider.
Timeline
Every entry labeled: documented (primary/on-chain
evidence preserved) · reported (community/press, unverified) ·
open (unresolved).
2026-09-25 — First
inbound drain transfer to the shared collector 0x0c7c6561…. The drainer
infrastructure predates the Multiplifi compromise by ~2 weeks — a serial operation.
Oct 9, 2026 — Users
begin reporting multipli.fi unresponsive/suspicious. Compromise window
opens (per victim reports; exact start unresolved).
Oct 10, 2026 — First
documented drain via the fake login: victim approves spender 0x3b2c3fdf…,
operator 0x3ef438c3… execs, ~2,013 xUSDT swept to collectors in tx
0x5b8d93a5….
Oct 10–13 — Protocol
posts a low-visibility "suspicious activity" notice on a founder's personal account;
official @multiplifi handle does not prominently warn users. Victim
tickets pile in Discord; mods promise response "by Oct 15."
Oct 9–14 — 27
unique senders drained into the collectors across 41 inbound transfers — the
incident-window victim census.
Oct 14, 23:51 UTC — Latest inbound to collector — the drainer is still active as of this
census.
Present — Attribution,
the compromise's entry vector (DNS hijack vs. frontend-code injection), and the
protocol's disclosure/remediation timeline are all unresolved.