{"investigation":{"slug":"eigenlayer","entity_name":"Eigenlayer","trust_score":58,"severity_base":null,"score_modifier":26,"confidence":1,"status":"published","content_type":"investigation","summary":"EigenLayer is a legitimate Ethereum restaking protocol operated by Eigen Labs that became a high-value target for phishing campaigns, wallet drainer attacks, and social engineering in 2024 following the launch of its EIGEN token. In October 2024 alone, the protocol's official X account was compromised to promote a fake airdrop resulting in at least $800,000 lost by one victim, and a separate email-based social engineering attack redirected approximately $5.7 million in locked investor tokens to an attacker's wallet. EIGEN holders and restakers face an elevated and persistent threat surface from impersonation sites, fake airdrop claims, and token-approval drainer schemes that exploit the protocol's name and brand recognition.","sections":[{"content":"EigenLayer is a decentralized restaking protocol built on Ethereum, developed by Eigen Labs. It allows ETH stakers to restake their assets to provide cryptoeconomic security to additional decentralized services called Actively Validated Services (AVSs). EigenLayer grew to become one of the largest protocols on Ethereum by total value locked (TVL). The native EIGEN token was airdropped to stakers beginning May 10, 2024, with employees and early investors subject to a one-year lockup period running through September 2025, followed by a 4% monthly unlock schedule through September 2027. The protocol's prominence and large staker base made it an attractive target for fraudsters.","heading":"Background: EigenLayer Protocol","sources":[],"severity":"medium"},{"content":"On October 18, 2024, EigenLayer's official X (formerly Twitter) account was compromised. Attackers posted fraudulent announcements claiming to reallocate EIGEN tokens as part of a fake Season 2 airdrop, despite the legitimate Season 2 claim period having already closed the previous month. ZachXBT was among the first to publicly warn users, posting on his Telegram channel: 'Eigenlayer X/Twitter account is currently compromised do not click any links.' The malicious posts directed users to a phishing site at 'blog.eigenfoundation.org,' closely mimicking the legitimate EigenLayer blog at 'blog.eigenlayer.xyz.' Upon connecting their wallets to the fraudulent site to 'claim EIGEN,' victims triggered a wallet drainer. Security analyst Scam Sniffer reported that at least one victim lost approximately $800,000 in mETH (Mantle Staked Ether) tokens. The attack exploited X platform design features to conceal the malicious link. Eigen Labs issued a warning via their backup account @eigen_labs, advising users not to engage with suspicious links. This was the second security incident EigenLayer experienced in October 2024 alone.","heading":"X Account Compromise and Fake Airdrop Wallet Drainer (October 2024)","sources":[],"severity":"medium"},{"content":"On approximately October 4, 2024, EigenLayer announced it was investigating an unauthorized sale of approximately 1,673,645 EIGEN tokens (valued at roughly $5.5–5.7 million at the time) from a wallet address (0x87787389BB2Eb2EC8Fe4aA6a2e33D671d925A60f). Blockchain analytics firm Lookonchain and Arkham Intelligence initially flagged the suspicious transaction; the tokens were traceable to an EigenLayer team wallet funded by the protocol's multi-signature Gnosis Safe. EigenLayer subsequently concluded the incident was a sophisticated social engineering attack rather than an insider token dump: an attacker had compromised an email thread between EigenLayer and an investor who was in the process of transferring tokens into custody. By impersonating both the investor and the custodian via spoofed emails, the attacker redirected the 1,673,645 EIGEN tokens to their own wallet address. The attacker then swapped the tokens for stablecoins via MetaMask and transferred the proceeds to centralized exchanges. The EigenLayer team worked with centralized exchanges and law enforcement to freeze a substantial portion of the stolen funds. EigenLayer credited ZachXBT, zeroShadow, and Cryptoforensic Investigators in their investigation. The incident highlighted a critical process vulnerability: EigenLayer's use of email to collect investor wallet addresses for high-value token distributions made email security a core attack surface.","heading":"Email Social Engineering Attack on Investor Token Transfer (October 2024)","sources":[],"severity":"medium"},{"content":"Following the EIGEN token launch in October 2024, critics raised concerns about the transparency of EIGEN's true circulating supply (float). A 0xResearch newsletter published by Blockworks questioned the opacity of EIGEN's actual float, noting that private investor lockup schedules and allocation disclosures were insufficiently clear at launch. The concern centered on the large proportion of tokens subject to lockup held by employees and early investors, combined with insufficient on-chain or public disclosure of these allocations at the time of trading launch. EigenLayer's EIGEN token lockup required a one-year freeze on selling for employees and early investors from the May 2024 airdrop date, followed by 4% monthly unlocks starting September 2025. The Eigen Foundation subsequently published a formal disclosure regarding lockup schedules and staking rules. While not a fraud allegation, the controversy contributed to reputational risk and lowered community trust in the protocol's governance of its token economics.","heading":"Token Transparency and Float Controversy","sources":[],"severity":"medium"},{"content":"EigenLayer's brand recognition and large staker base have made it a persistent target for impersonation fraud across social media and web platforms. Security reports from imToken Wallet noted that EigenLayer is among prominent restaking projects including Ether.fi, Puffer Finance, and Renzo that are routinely targeted by scammers creating fake social media accounts with names closely resembling official handles. Fake restaking sites and wallet-approval drainer schemes use the EigenLayer name to deceive users into submitting malicious transaction approvals. The attack pattern typically involves: (1) impersonation of official accounts or creation of lookalike domains; (2) urgency messaging around airdrops or token claims; (3) wallet connection prompts triggering unlimited token approval signatures or direct drainer scripts. Users are advised to verify all EigenLayer interactions exclusively through the official domain eigenlayer.xyz and to treat any airdrop announcement with heightened skepticism.","heading":"Broader Phishing and Impersonation Ecosystem","sources":[],"severity":"medium"},{"content":"Given the documented threat ecosystem around EigenLayer, EIGEN holders and active restakers face material risks from phishing and social engineering. Key protective measures include: verifying all official announcements exclusively at eigenlayer.xyz and the @eigen_labs X account; treating any airdrop claim or token reallocation announcement with maximum skepticism, particularly when the official claim period has closed; never connecting wallets to any site not confirmed directly through official channels; regularly auditing wallet token approvals using tools such as Revoke.cash; and monitoring ZachXBT's Telegram channel for real-time compromise alerts. EigenLayer does not solicit wallet connections or airdrop claims through any channel other than its official app interface.","heading":"User Safety Guidance for EIGEN Holders and Restakers","sources":[],"severity":"medium"}],"timeline":[{"date":"2024-05-10","event":"EigenLayer begins EIGEN token airdrop (Season 1 stakedrop); employees and investors subject to one-year lockup period.","source":"","source_url":"https://www.theblock.co/post/319620/eigenlayer-investigates-suspicious-wallet-that-sold-5-5-million-worth-of-eigen-tokens-potentially-violating-the-lockup-schedule"},{"date":"2024-10-04","event":"EigenLayer announces investigation into unauthorized sale of approximately 1,673,645 EIGEN tokens (~$5.7M) from wallet 0x87787389BB2Eb2EC8Fe4aA6a2e33D671d925A60f, later attributed to a social engineering attack on an investor email thread.","source":"","source_url":"https://www.theblock.co/post/319689/eigenlayer-erroneously-transferred-5-5-million-worth-of-tokens-to-attacker-statement"},{"date":"2024-10-04","event":"Lookonchain and Arkham Intelligence trace the suspicious EIGEN token sale to EigenLayer team wallet; ZachXBT credited in subsequent investigation announcement.","source":"","source_url":"https://cryptobriefing.com/eigenlayer-token-sale-investigation/"},{"date":"2024-10-18","event":"EigenLayer's official X account is compromised; attackers post fraudulent EIGEN Season 2 airdrop announcements linking to phishing site blog.eigenfoundation.org. ZachXBT issues Telegram alert warning users not to click any links.","source":"","source_url":"https://decrypt.co/287159/eigenlayer-twitter-hack-airdrop-scam"},{"date":"2024-10-18","event":"At least one victim loses approximately $800,000 in mETH to the fake airdrop wallet drainer; Scam Sniffer reports the loss. Eigen Labs issues warning via backup @eigen_labs account.","source":"","source_url":"https://cryptonews.com/news/victim-loses-800k-in-eigenlayer-x-account-hack-airdrop-scam/"},{"date":"2024-10-29","event":"EigenLayer completes investigation on the $5.7M email hack, confirming social engineering via compromised email thread and noting partial fund recovery through exchange cooperation and law enforcement.","source":"","source_url":"https://www.cryptopolitan.com/eigenlayer-investigation-5-7m-hack/"}],"sources_used":[{"url":"https://www.theblock.co/post/321939/eigenlayer-x-account-hack-fake-airdrop","name":"EigenLayer's official X account hacked to promote fake airdrop - The Block","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/287159/eigenlayer-twitter-hack-airdrop-scam","name":"EigenLayer Twitter Hack: Airdrop Scam - Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260114141429/https://decrypt.co/287159/eigenlayer-twitter-hack-airdrop-scam","credibility":2,"archive_timestamp":"2026-01-14T14:14:29+00:00"},{"url":"https://cryptonews.com/news/victim-loses-800k-in-eigenlayer-x-account-hack-airdrop-scam/","name":"Victim Loses $800K in EigenLayer X Account Hack Airdrop Scam - CryptoNews","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/319620/eigenlayer-investigates-suspicious-wallet-that-sold-5-5-million-worth-of-eigen-tokens-potentially-violating-the-lockup-schedule","name":"EigenLayer investigates suspicious wallet that sold $5.5 million worth of EIGEN tokens - The Block","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/319689/eigenlayer-erroneously-transferred-5-5-million-worth-of-tokens-to-attacker-statement","name":"EigenLayer erroneously transferred $5.5 million worth of tokens to attacker: statement - The Block","type":"news_article","archive_url":"http://web.archive.org/web/20250622172604/https://www.theblock.co/post/319689/eigenlayer-erroneously-transferred-5-5-million-worth-of-tokens-to-attacker-statement","credibility":2,"archive_timestamp":"2025-06-22T17:26:04+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-eigenlayer-investor-hack-october-2024","name":"Explained: The EigenLayer Investor Hack (October 2024) - Halborn","type":"research","archive_url":"http://web.archive.org/web/20260315180107/https://www.halborn.com/blog/post/explained-the-eigenlayer-investor-hack-october-2024","credibility":2,"archive_timestamp":"2026-03-15T18:01:07+00:00"},{"url":"https://cryptobriefing.com/eigenlayer-token-sale-investigation/","name":"EigenLayer investigates unauthorized EIGEN token sale - Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20260525201558/https://cryptobriefing.com/eigenlayer-token-sale-investigation/","credibility":2,"archive_timestamp":"2026-05-25T20:15:58+00:00"},{"url":"https://www.cryptopolitan.com/eigenlayer-investigation-5-7m-hack/","name":"EigenLayer completes investigation on $5.7M hack - Cryptopolitan","type":"news_article","archive_url":"https://web.archive.org/web/20260724213935/https://www.cryptopolitan.com/eigenlayer-investigation-5-7m-hack/","credibility":2,"archive_timestamp":"2026-07-24T21:39:35+00:00"},{"url":"https://www.cryptonewsz.com/eigenlayer-x-account-has-just-been-hacked-zachxbt/","name":"EigenLayer X account has just been hacked - ZachXBT (via CryptoNewsZ)","type":"news_article","archive_url":"https://web.archive.org/web/20260724213934/https://www.cryptonewsz.com/","credibility":2,"archive_timestamp":"2026-07-24T21:39:34+00:00"},{"url":"https://blockworks.co/news/0xresearch-newsletter-eigen-tokens-transparency","name":"Critics question the transparency and true float of EIGEN tokens - Blockworks","type":"news_article","archive_url":"http://web.archive.org/web/20260114071351/https://blockworks.co/news/0xresearch-newsletter-eigen-tokens-transparency","credibility":2,"archive_timestamp":"2026-01-14T07:13:51+00:00"},{"url":"https://dailycoin.com/eigenlayer-x-account-hacked-to-promote-fake-airdrop-heres-what-we-know/","name":"EigenLayer X Account Hacked to Promote Fake Airdrop - DailyCoin","type":"news_article","archive_url":"http://web.archive.org/web/20250709063910/https://dailycoin.com/eigenlayer-x-account-hacked-to-promote-fake-airdrop-heres-what-we-know/","credibility":2,"archive_timestamp":"2025-07-09T06:39:10+00:00"},{"url":"https://unchainedcrypto.com/eigenlayer-says-5-5-million-hack-from-compromised-email-thread-is-an-isolated-incident/","name":"EigenLayer Says $5.5 Million Hack From Compromised Email Thread Is An Isolated Incident - Unchained","type":"news_article","archive_url":"https://web.archive.org/web/20260724181019/https://unchainedcrypto.com/eigenlayer-says-5-5-million-hack-from-compromised-email-thread-is-an-isolated-incident/","credibility":2,"archive_timestamp":"2026-07-24T18:10:19+00:00"},{"url":"https://www.bankless.com/email-breach-causes-eigenlayers-5-5m-token-heist","name":"Email Breach Causes $5.5M EIGEN Token Heist - Bankless","type":"news_article","archive_url":"http://web.archive.org/web/20251111193339/https://www.bankless.com/email-breach-causes-eigenlayers-5-5m-token-heist","credibility":2,"archive_timestamp":"2025-11-11T19:33:39+00:00"},{"url":"https://support.token.im/hc/en-us/articles/31819758350617-Beware-of-Fake-Twitter-Accounts-and-Restaking-Scams-imToken-Wallet-Security-Monthly-Report-25th-Issue","name":"Beware of Fake Twitter Accounts and Restaking Scams - imToken Wallet Security Report","type":"community_report","archive_url":"http://web.archive.org/web/20250910211132/https://support.token.im/hc/en-us/articles/31819758350617-Beware-of-Fake-Twitter-Accounts-and-Restaking-Scams-imToken-Wallet-Security-Monthly-Report-25th-Issue","credibility":3,"archive_timestamp":"2025-09-10T21:11:32+00:00"},{"url":"https://docs.eigenfoundation.org/legal/disclosure-regarding-lockup-staking","name":"Disclosure Regarding Lock-Up Schedules, Staking, and Related - Eigen Foundation","type":"official","archive_url":"http://web.archive.org/web/20251231165157/https://docs.eigenfoundation.org/legal/disclosure-regarding-lockup-staking","credibility":1,"archive_timestamp":"2025-12-31T16:51:57+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T16:04:59.746643+00:00","updated_at":"2026-08-29T01:35:53.192+00:00"}}