A security vulnerability is actively being exploited by malicious individuals to illegitimately acquire WLFI tokens from Ethereum
According to Yu Xian of SlowMist, in a message posted on X on September 1st, cybercriminals are taking advantage of a recently implemented Ethereum improvement proposal, identified as EIP-7702. This exploit is being used to transfer funds from users’ accounts after unauthorized access is gained.
The Ethereum network’s update in May implemented EIP-7702. This allows standard wallets to temporarily function similarly to smart contract wallets.
Did you know?
Subscribe – We publish new crypto explainer videos every week!
What is Balancer in Crypto? Beginner Friendly BAL Explainer
Yu Xian clarified that the process involves attackers first compromising a user’s private key. Subsequently, they establish a delegate contract associated with the affected wallet. This contract enables the attacker to authorize and execute transactions without the user’s permission.
Once the compromised wallet receives funds, like WLFI tokens, the attacker can swiftly transfer them to their own account.
An instance reported on August 31st details how an X user reported the theft of their friend’s WLFI tokens after they transferred ETH into the wallet. Yu Xian verified that this situation appeared to be a “Classic EIP-7702 phishing exploit.”
Yu Xian also pointed out that even when users attempt to move any remaining tokens from a compromised wallet, the gas fees associated with the transaction can be diverted to the attacker.
To mitigate the potential damage, Yu Xian suggested revoking or replacing the delegate contract linked to EIP-7702. It’s also advised to transfer any remaining tokens to a safe and secure wallet without delay.
In related news, Anthropic has cautioned that its AI chatbot, Claude, is being improperly utilized by malicious individuals to facilitate illicit activities online. Learn more by reading the full story here.