World Liberty Financial (WLFI) token holders are encountering significant losses due to a recent phishing attack linked to Ethereum's EIP-7702 upgrade.
EIP-7702 Vulnerability and Its Exploitation
Following an Ethereum update aimed at improving transaction efficiency, hackers are leveraging this feature to embed malicious contracts into wallets with leaked private keys. Security expert Yu Xian from SlowMist highlighted that the attack relies on stolen private keys, typically acquired through phishing scams. Once attackers gain access to a wallet's private key, they implant a delegate smart contract related to the EIP-7702 upgrade. When victims deposit WLFI tokens, the funds are instantly redirected to the hacker's address.
Community Response to WLFI Theft
Affected users are actively discussing thefts in WLFI forums, expressing frustration over automatic draining by 'sweeper bots.' One user reported only managing to safely transfer 20% of their tokens before the remaining 80% were stolen. Others raised concerns about the token drop system's reliance on whitelisted wallets, which exacerbates vulnerability.
Preventive Measures by the WLFI Team
In response to the threat, the WLFI team has urged token holders to remain cautious of phishing attempts, explicitly stating that the project will never communicate with users through direct messages on social platforms. Official communications are only through verified email domains. The team also strongly recommends users secure their private keys and consider moving tokens from compromised wallets.
The current situation emphasizes the need for vigilance in the crypto ecosystem, especially following high-profile token launches. The WLFI community continues to seek solutions, including enhanced token transfer mechanisms to prevent further exploitation.
