Airdrop Army

In the latest saga of on-chain mishaps, the EigenLayer crew is deep in damage control mode. A wallet linked to their $5.5 million EIGEN token dump last week has stirred the pot. The team still grapples with the mess left behind from this “unapproved selling activity,” sending waves across the DeFi space.

But the story got juicier. On Oct. 4, EigenLayer announced on X (formerly Twitter) that an email thread involving one investor’s token transfer had been hijacked. Yep, social engineering strikes again. The crew got duped by a malicious actor who misled them into transferring tokens to the attacker’s wallet. They even ran a test transaction with 1 EIGEN the day before. The end result? $5.5 million of EIGEN flushed into the attacker’s bag.

Blockchain Shenanigans and the Token Sale Fallout

MetaMask’s “Swap” feature was where it all went down. Blockchain data shows the attacker sold the stolen EIGEN on a decentralized exchange. Even though the token stack was worth $5.5 million, the attacker only managed to snag around $3.1 million in USDC after offloading the tokens.

Law enforcement got looped in fast, and a chunk of the stolen funds got frozen. EigenLayer emphasized to its community that no protocol vulnerability was exploited, so no need to worry about your staked ETH for now. However, the explanation didn’t sit well with some in the crypto trenches. Folks started asking the tough questions—like, why were these tokens handed over directly to investors without any vesting contract? After all, these were supposed to be locked up.

Andreas Pensold, CEO of decentralized physical infrastructure networks firm Pindora, didn’t hold back. “We trust Web3 to eliminate human error with smart contracts, but many projects still rely on manual handling of token vesting. We need to stop this ASAP,” he commented.

Social Engineering and Security Lessons

Ido Ben Natan, CEO at Blockaid, wasn’t surprised. He pointed out that attackers keep exploiting human errors rather than technical bugs. According to him, “time and again, we see attackers exploiting not technical flaws, but rather gaps in what should be routine verification steps by now.” Even a basic address check could’ve saved the day.

Artem Irgebaev from Immunefi agreed, doubling down on the importance of anti-phishing training. He said, “anti-phishing training and rules prove to be the best way to minimize the effect of phishing attacks.”