Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/eigenlayerofficialxaccountreallocationphishing.php}} {{Unattributed Sources}} EigenLayer HomepageEigenLayer is another restaking platform, which offers Ethereum holders the ability to earn more staking rewards on their already staked Ethereum. On October 18th, 2024 their X account promised that a new round of token allocation would happen, in line with thei..."

2024-11-12T22:36:22Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/eigenlayerofficialxaccountreallocationphishing.php}} {{Unattributed Sources}} thumb|EigenLayer HomepageEigenLayer is another restaking platform, which offers Ethereum holders the ability to earn more staking rewards on their already staked Ethereum. On October 18th, 2024 their X account promised that a new round of token allocation would happen, in line with thei..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/eigenlayerofficialxaccountreallocationphishing.php}}
{{Unattributed Sources}}

[[File:Eigenlayer.jpg|thumb|EigenLayer Homepage]]EigenLayer is another restaking platform, which offers Ethereum holders the ability to earn more staking rewards on their already staked Ethereum. On October 18th, 2024 their X account promised that a new round of token allocation would happen, in line with their "programmatic incentives" program. In reality, their account was taken over by hackers and anyone who approved the malicious smart contract would have their wallet drained. It has been reported that over $1m was lost, including one user who lost $804k.<ref name="odailynews-16733" /><ref name="mikadontlouztwitter-16734" /><ref name="aura3iotwitter-16735" /><ref name="mdtradetwitter-16736" /><ref name="noahmetaxtwitter-16737" /><ref name="cryptojosejmtwitter-16738" /><ref name="takuri333twitter-16739" /><ref name="marketfeelingtwitter-16740" /><ref name="bradicoin10twitter-16741" /><ref name="cryptogenius419twitter-16742" /><ref name="luckytraderhqtwitter-16743" /><ref name="cryptostowatchtwitter-16744" /><ref name="becrusaderstwitter-16745" /><ref name="rssbittwitter-16746" /><ref name="derekjoe56555twitter-16747" /><ref name="altcoinwavetwitter-16748" /><ref name="bitboxnewstwitter-16749" /><ref name="cryptomaktwitter-16750" /><ref name="cryptodenlivetwitter-16751" /><ref name="byteainewsbottwitter-16752" /><ref name="btcpulsetwitter-16753" /><ref name="pnxgrptwitter-16754" /><ref name="cryptonewstwitter-16755" /><ref name="godofethtwitter-16756" /><ref name="penkendraatwitter-16757" /><ref name="tknwiretwitter-16758" /><ref name="figoethtwitter-16759" /><ref name="problockchaintwitter-16760" />

== About Eigenlayer ==
"EigenLayer is a protocol built on Ethereum that introduces restaking, a new primitive in cryptoeconomic security. This primitive enables the reuse of ETH on the consensus layer. Users that stake ETH natively or with a liquid staking token (LST) can opt-in to EigenLayer smart contracts to restake their ETH or LST and extend cryptoeconomic security to additional applications on the network to earn additional rewards."

"We're happy to announce that eligible participants for Season 2 have been reallocated EIGEN tokens! Now that we are transitioning into Programmatic incentives, the remaining EIGEN supply for Season 2 has been redistributed. Get started."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Eigenlayer Official X Account Reallocation Phishing
!Date
!Event
!Description
|-
|October 18th, 2024 3:40:00 AM MDT
|X Account Breach Occurs
|According to a later tweet by Eigen Labs, their X account was breached "at roughly 5:40am ET".
|-
|October 18th, 2024 4:18:00 AM MDT
|GODofETH Tweet Warning
|X user GODofETH posts a tweet warning about the hacked account.
|-
|October 18th, 2024 4:42:00 AM MDT
|CyversAlerts Tweet Loss
|CyversAlerts reports $804k lost when one user signs the malicious phishing contract from EigenLayer.
|-
|October 18th, 2024 2:34:00 PM MDT
|TknWire Loss Estimate Report
|TknWire reports that $800k has been lost as part of the phishing scam.
|-
|October 18th, 2024 5:54:00 PM MDT
|TknWire Loss Estimate Report
|TknWire reports that $1m has been lost as part of the phishing scam.
|-
|October 18th, 2024 7:15:00 PM MDT
|Eigen Labs Posts Tweet
|Eigen Labs posts a tweet where they highlight that the account breach happened "at roughly 5:40am ET". They appearently had responded within 20 minutes. The account is locked and they are recovering full access. This account will be used for updates in the meantime.
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost has been estimated at $1,000,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
"ALERT Our system has just detected that someone lost around 804K worth of $mETH signing a malicious phishing contract!

Victim 0x84b....42E43 has approved malicious contract around 14 min ago! We advise to revoke all your approvals for phisher contract! Funds are currently sitting at phisher's address!"

"The official X account of Eigenlayer, the Ethereum re-staking protocol, is suspected to have been hacked. The hacker has posted a fake phishing link; please do not interact with it."

"This morning, at roughly 5:40am ET, the @eigenlayer twitter account was compromised, malicious tweets were posted containing phishing links, and we were locked out of the account.

Within 20 minutes, we were actively investigating and containing the situation with the help of security consultants @_SEAL_Org & @BrainchainLLC. By 11:00am ET, X Support locked down the account. We are now in the process of recovering full access.

After an in-depth investigation of our internal tools, devices, and activity logs, we have found no evidence of suspicious activity or breach across any of our systems or users. The robust security measures on our X account—including passkey 2FA, delegated access controls, and additional layers of protection—also show no evidence of being compromised.

Security and the trust of our community are our top priorities, and we are continuing to investigate all potential root causes of this incident, including X potentially being directly compromised via social engineering/phishing. In addition, we are exploring all options for pursuing the attacker, including working with onchain forensics teams and law enforcement.

Once we regain access to @eigenlayer, we will alert the community with an update. In the meantime, all EigenLayer official communications will come from this account @eigen_labs."

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="odailynews-16733">[https://www.odaily.news/newsflash/396129 EigenLayer官方X账户疑似被盗，用户需注意风险_快讯-odaily] (Accessed Nov 11, 2024)</ref>

<ref name="mikadontlouztwitter-16734">[https://twitter.com/mikadontlouz/status/1847467626991087746 @mikadontlouz Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="aura3iotwitter-16735">[https://twitter.com/aura3_io/status/1847712789151764923 @aura3_io Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="mdtradetwitter-16736">[https://twitter.com/mdtrade/status/1847309794857636066 @mdtrade Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="noahmetaxtwitter-16737">[https://twitter.com/noahmetaX/status/1847555940012138936 @noahmetaX Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptojosejmtwitter-16738">[https://twitter.com/CryptoJoseJM/status/1847352161832665493 @CryptoJoseJM Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="takuri333twitter-16739">[https://twitter.com/Takuri333/status/1847568565567934719 @Takuri333 Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="marketfeelingtwitter-16740">[https://twitter.com/Market_Feeling/status/1847299109431963794 @Market_Feeling Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="bradicoin10twitter-16741">[https://twitter.com/Bradicoin10/status/1847540495850901866 @Bradicoin10 Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptogenius419twitter-16742">[https://twitter.com/CryptoGenius419/status/1847605449907978593 @CryptoGenius419 Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="luckytraderhqtwitter-16743">[https://twitter.com/LuckyTraderHQ/status/1847265632196108707 @LuckyTraderHQ Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptostowatchtwitter-16744">[https://twitter.com/CryptosToWatch/status/1847601154009563148 @CryptosToWatch Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="becrusaderstwitter-16745">[https://twitter.com/BeCrusaders/status/1847526619113480446 @BeCrusaders Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="rssbittwitter-16746">[https://twitter.com/RssBit/status/1847522788183093510 @RssBit Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="derekjoe56555twitter-16747">[https://twitter.com/DerekJoe56555/status/1847532664300957750 @DerekJoe56555 Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="altcoinwavetwitter-16748">[https://twitter.com/AltcoinWave/status/1847670036065894681 @AltcoinWave Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="bitboxnewstwitter-16749">[https://twitter.com/BitBoxNews/status/1847523567979708541 @BitBoxNews Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptomaktwitter-16750">[https://twitter.com/crypto__mak/status/1847512048575582225 @crypto__mak Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptodenlivetwitter-16751">[https://twitter.com/CryptoDenLive/status/1847692439248609726 @CryptoDenLive Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="byteainewsbottwitter-16752">[https://twitter.com/ByteAINewsBot/status/1847594914638389279 @ByteAINewsBot Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="btcpulsetwitter-16753">[https://twitter.com/btc_pulse_/status/1847620801651978358 @btc_pulse_ Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="pnxgrptwitter-16754">[https://twitter.com/pnxgrp/status/1847691689088970863 @pnxgrp Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="cryptonewstwitter-16755">[https://twitter.com/cryptonews/status/1847332714762162408 @cryptonews Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="godofethtwitter-16756">[https://twitter.com/GODofETH/status/1847220749821411719 @GODofETH Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="penkendraatwitter-16757">[https://twitter.com/Penkendraa/status/1847286316888699220 @Penkendraa Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="tknwiretwitter-16758">[https://twitter.com/TknWire/status/1847425986616320028 @TknWire Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="figoethtwitter-16759">[https://twitter.com/FigoETH/status/1847286369585889566 @FigoETH Twitter] (Accessed Nov 11, 2024)</ref>

<ref name="problockchaintwitter-16760">[https://twitter.com/PRO_BLOCKCHAIN/status/1847512247754768784 @PRO_BLOCKCHAIN Twitter] (Accessed Nov 11, 2024)</ref></references>

Eigenlayer Official X Account Reallocation Phishing - Revision history