I need answers
@multiplifi , and the community needs answers too.
On Sat, Oct 10 morning, I wanted to check my Multiplifi yield. Like always, I went to Multiplifi's official X handle and copied the link from
@multiplifi own X page.
The site was unresponsive. It kept freezing, so I thought it was my network connection. In my 1inch wallet browser, I hit "connect wallet" repeatedly. Connect hung, then a signature popped up. I signed, thinking it was a login. Then the site went blank again. I left it think it was my connectivity
On Monday, I came back to the website and it was still not opening. I checked their X; no announcement. I commented on their latest post asking if their website was down. I searched for their Discord and joined. In their Discord, I asked if the website was down, and the admin said the website should be up (at this time, I wasn't aware that their website frontend was compromised).
So today, I came back again and noticed that 1inch wallet flagged the site as suspicious. I became curious and went back to their Discord again. Only then did I find out the founder had tweeted that the frontend was compromised. The official handle never posted or reposted it.
I checked BscScan: exec calls from my wallet, and my xUSDT redeemed on Oct 10, the same day I signed that popup. I hadn’t noticed.
Approval Tx
bscscan.com/tx/0xa6c60ffdb71…
xUSdt token transfer
bscscan.com/tx/0x5b8d93a5cdd…
bscscan.com/tx/0x5b8d93a5cdd…
I came back to my 1inch wallet and saw the same thing.
I opened a ticket on their Discord. A mod replied that he had forwarded it to the team and that the estimated response might be by the end of the day on the 15th October.
I ALWAYS copy the link from
@multiplifi’s X page before visiting. One warning post there would have saved me.
Why stay silent while users were being drained?
The address that executed this has over 1,000 transactions; I am not the only victim.
If you used the Multipli website from Oct 9 onward, you may need to pay attention to your wallet.
@multiplifi , a tweet or repost on the official page would have saved my funds and those of others. Why act like nothing as dangerous as your frontend being compromised happened?
I still need answers.