According to Wu Blockchain, SlowMist’s Cosine posted on X that user Babur disclosed the theft of approximately $27 million in crypto assets. Analysis shows that the stolen assets were mainly concentrated in two addresses: Solana address 91xu and Ethereum Safe multisig address 0xD2, with the two largest stolen amounts totaling over $18 million. Some of the funds have already been bridged to the Ethereum network. Cosine stated that the incident is suspected to have been caused by a trojan infection on the computer, and after the user double-clicked a malicious file, the private keys were leaked. It is also possible that both private keys required for the Safe multisig were stored on the compromised computer.