EigenLayer Loses 1.67 Million EIGEN Tokens to a Compromised Email Thread

EigenLayer, the restaking protocol widely credited with driving Ethereum's recent staking boom, disclosed a roughly $6 million token loss traced back to a compromised email exchange rather than a smart contract flaw.

The incident stemmed from the project's manual approach to distributing tokens to investors: recipients were expected to submit their ETH address by email. An attacker inserted themselves into one such thread, swapped in a wallet address they controlled, and received the transfer intended for a legitimate investor.

EigenLayer first acknowledged the situation in a public post, stating it was "investigating unapproved selling activity" tied to the wallet 0xa7a1c66168cc0b5fc78721157f513c89697df10d. A test transaction associated with the transfer process can be found at 0xc997f69dc4d22cec10e236433822c194765ed56f911890552e733268c3f2cbbb.

Hours later, the team offered a fuller account in a follow-up statement: "In an isolated incident this morning, an email thread involving one investor's transfer of tokens into custody was compromised by a malicious attacker." In total, 1,673,645 EIGEN tokens were diverted.

According to blockchain analytics firm Arkham Intelligence, the tokens moved out of EigenLayer's multi-signature Gnosis Safe, tagged at 0x87787389BB2Eb2EC8Fe4aA6a2e33D671d925A60f. On-chain researcher Lookonchain tracked the tokens as they left an EigenLayer team wallet before being sold through MetaMask.

The sale is notable because it appears to conflict with EigenLayer's published lockup schedule, under which employees and early investors are barred from selling or staking until September 2025, followed by a 4% monthly unlock, with full unlock not arriving until September 2027. EIGEN's token distribution only began on May 10, 2024, meaning the tokens involved here were still well within the restricted period. Market pricing at the time of the sale was reported at $3.59 per token.

EigenLayer maintains that the breach was confined to the compromised email thread and did not touch the protocol or token contracts themselves, and says it is coordinating with affected platforms and law enforcement.

EigenLayer's total value locked stood at close to $11 billion at the time of the incident, drawing attention to the gap between the protocol's technical sophistication and the informal, email-based process it used for token custody transfers.

Credit: DefiLlama, Eigenlayer, Arkham Intelligence, Lookonchain