EigenLayer Concludes Investigation Into $6M October Incident, Unveils New Security Measures

EigenLayer emphasized that the investigation focused on a comprehensive analysis of the protocol's token transfer approval process to identify any vulnerabilities that may result in a similar incident.

Ethereum stake protocol EigenLayer has concluded investigations concerning the isolated incident that drained an individual wallet of close to $6 million worth of EIGEN tokens. The incident occurred earlier in October when an attacker managed to manipulate a token transfer process, ultimately leading to the theft of the funds.

EigenLayer has highlighted that the incident did not affect the protocol’s internal infrastructure, including the website, protocols, or token smart contracts. The investigations also revealed that the incident was not related to any on-chain dysfunctionality.

Investigations focused on analyzing the protocol’s token transfer approval process to identify any vulnerabilities that may have contributed to the incident. The aim was also to identify any points of improvement to minimize similar risks in the future.

“Following our first report of this isolated incident involving multiple parties on October 4th, 2024, the investigation of this incident has been completed. The incident did not affect our website, any protocol or token smart contracts, and was not related to any onchain…”

After the initial report of the incident, several parties, including third-party investigators ZachXBT, zeroShadow, and Cryptoforensic, assisted in the investigations. Additionally, law enforcement was able to freeze a significant portion of the stolen funds.

EigenLayer had also engaged SlowMist, a blockchain security company, to investigate the incident. SlowMist’s investigations revealed that the incident was an external malicious attack.

According to SlowMist, one of Eigen Labs’ investors experienced a phishing attack that led to the subsequent compromise. The attacker managed to gain access to an email conversation between the custodian, the investor, and Eigen Labs, where the parties were discussing the transfer of the investor’s tokens to a custodian.

The attacker then created lookalike emails, posing as the investor and the custodian. Subsequently, using the spoofed investor email, the attacker responded to the thread and included their address instead of the custodial address.

The attacker confirmed the receipt of a test transaction, posing as the custodian, and the subsequent transaction involving 1,673,645 EIGEN tokens was executed without further confirmation.

“The attacker sold these stolen EIGEN tokens via a decentralized swap platform and transferred stablecoins to centralized exchanges.”

EigenLayer

The attacker proceeded to swap the EIGEN tokens to stablecoins through a decentralized swap platform and then transferred the tokens to centralized exchanges. The security team at Eigen Labs contacted law enforcement and the DeFi platform, leading to the freezing of a portion of the funds.

According to CoinMarketCap, EigenLayer’s native asset, EIGEN, has dipped by over 17% in the last seven days. EIGEN is currently trading at a price of $2.85 with a market cap of $531.2 million. The token surged to its all-time high of $4.53 at the beginning of October, but it is now down by 38%.