Parity Multi-Sig Wallet Freeze — November 2017

The Parity Wallet was a popular multi-signature wallet contract for Ethereum developed by Parity Technologies. Multi-sig wallets deployed by users were proxies that delegated their core logic to a single shared library contract at a fixed address.

The library contract's 'initWallet' function — which set the wallet's owners — had no permission check. On 19 July 2017 an attacker exploited this to drain three multi-sig wallets of 153,037 ETH. Parity patched the user-facing wallets but did not redeploy the library contract.

On 6 November 2017 a GitHub user calling themselves 'devops199' invoked the unprotected 'initWallet' on the library directly, becoming its sole owner. They then called 'kill', which triggered the contract's selfdestruct() and removed it from the chain. Every proxy wallet that depended on the library — approximately 587 of them, holding 514,000 ETH — lost its delegated logic and became unable to sign transactions.

Parity and the broader Ethereum community proposed protocol-level recovery (most notably EIP-156 and EIP-867) that would have allowed selective unfreezing of the affected wallets. None reached consensus. The funds remain frozen at the time of writing.