Remilia Wallet Breach
 | |
| Type | Theft of cryptocurrency and NFTs |
|---|---|
| Date | March 16, 2024 |
| Outcome | Loss of Remilia's on-chain treasury and $FUMO liquidity; hard fork of $FUMO; new on-chain security protocol |
The Remilia Wallet Breach was the theft of Remilia Corporation's on-chain assets on March 16, 2024. An attacker obtained the private keys to Remilia's hot wallets and its multisignature treasury and took ether, the liquidity behind the $FUMO token, and several hundred Milady, Remilio and Kagami NFTs, which were then sold into market bids.[1] Remilia's operating treasury, held off-chain, was not affected, and the company's budgeted plans went ahead.[1] In the following weeks Remilia hard-forked $FUMO and adopted a new on-chain security protocol.
The attack
Remilia's technical post-mortem, written by Tim Clancy, describes the attack as taking place in two waves. The first began at 6:36 p.m. UTC, when the attacker's address started moving assets out of Remilia's wallets; Remilia noticed at about 7:30 p.m. At that point the multisig treasury needed three of four signatures, and the attacker had the private keys to three of the signers as well as to charlemagnefang.eth, remiliadao.eth and the wallet that managed the $FUMO liquidity.[1]
In the first wave the attacker took 195.1 ETH by pulling the $FUMO liquidity, 61 ETH and 110 Miladys from the treasury, $58,000 in USDC from a hot wallet, and 144 Miladys, 105 Remilios, 148 Kagami and 6 ETH from Remilia's NFTX liquidity. At 8:46 p.m. Remilia raised the treasury's threshold to four of four signatures and moved to fresh hardware, assuming a browser exploit. After rebooting, the team could no longer log in to the Bitwarden account where its private keys and wallet passwords were stored.[1]
The key for the fourth signer was kept in the same Bitwarden account. At 11:56 p.m. the attacker added themself to the multisig, removed the other signers and began a second wave, taking 17.4 WETH, a further 22 Miladys and 320 Remilios, and 211 ETH from Remilia's Blur pool.[1] The attacker sold the NFTs into open bids, for about 850 ETH in total.[2] The breach was first flagged publicly on X by Dumpster DAO.[3]
Response
On the day of the attack, Charlotte Fang wrote that the system holding all of Remilia's imported wallets had been hacked, that the main damage was to the $FUMO liquidity and the NFTs staked in NFTX, and that ownership of the NFT contracts was safe on hardware wallets.[4] The post-mortem said Remilia did not know exactly how the Bitwarden account was compromised and suspected malware or a cracked master password. It acknowledged that keeping every multisig key in one cloud account had been insecure.[1]
On March 18 the attacker briefly took over Fang's X account, using two-factor codes synced through Google Authenticator, and posted a fake donation address. Fang removed the post and locked the account down. One person had sent 0.1 ETH, and Fang returned 0.2 ETH. Fang also said that losing access to the password manager meant losing the recovery phrase for the hardware wallet that owned Remilia's NFT contracts. The contracts were safe from the attacker but could no longer be changed by Remilia either, so their ownership was effectively burned. Remilia had planned to pin the collections' metadata to IPFS before burning contract ownership, and instead redirected the metadata to pinned IPFS copies. Fang called the day "treasury decentralization day" and said teams had been hired to study the suspected malware and identify the attacker.[5]
Remilia said its primary operating treasury was held off-chain and that its runway for planned projects was unaffected beyond the ETH kept for on-chain expenses. The NFTs taken had been a long-term holding that it had not intended to sell.[1] Before any new on-chain launch, Remilia committed to a security protocol designed by Clancy: multisig signers would be separate people using their own hardware devices, and assets would be split across vaults that drain into one another, with emergency fallback addresses, timelocks and contract-level allowances.[1][5] Fang said the breach delayed but did not cancel the April launch of the first stage of the New Internet.[5]
$FUMO hard fork
Because the $FUMO liquidity could not be recovered, Remilia hard-forked the project on April 30, 2024. All $FUMO, except the attacker's, was force-redeemed into a new DN404 collection, Milady Fumo Baby 404, and the original Milady Fumo Baby contract was declared invalid because of the risk of a mass mint. A quarter of the force-minted Fumos carry a bloody overlay marking the 3/16 hack.[6]
See also
References
- ↑ 1.0 1.1 1.2 1.3 1.4 1.5 1.6 1.7 @_Enoch (March 16, 2024). "3/16 Hack - Technical Post-Mortem". X. Retrieved 2026-10-22.
- ↑ Samyuktha Sriram (2024-03-18). "Milady Founder Claims Hack After Millions in ETH and NFTs Drained". Unchained. Retrieved 2026-10-22.
- ↑ Zack Abrams (2024-03-16). "Remilia founder Charlotte Fang claims he was hacked as treasury is drained of millions". The Block. Retrieved 2026-10-22.
- ↑ @CharlotteFang77 (March 16, 2024). "My system was hacked and it compromised all imported wallets.". X. Retrieved 2026-10-22.
- ↑ 5.0 5.1 5.2 @CharlotteFang77 (March 18, 2024). "Ok I'm back.". X. Retrieved 2026-10-22.
- ↑ 2024-04-30. "Milady $FUMO Redux: $FUMO404 Hard Fork". Remilia Corporation. Retrieved 2026-10-22.