Worked example · 2024-20

EigenLayer restaking-frontend phishing cohort — Ethereum — 2024–2025

Loss

no aggregate figure is sourced. The one quantified case is the October 2024 hijack of EigenLayer's X account, in which at least $800K was lost by a single victim per Scam Sniffer (Decrypt, 2024-10-18). The earlier "mid-seven-figures" aggregate and the victim-loss range were unsupported and have been removed.

OAK Techniques observed

OAK-T3.005 (Fake-Validator Staking-Frontend Phishing — primary; the EigenLayer restaking interface is a staking-frontend phishing surface structurally similar to the Lido stETH staking-interface campaigns); OAK-T4.002 (Spoofed Token Approval — Blockaid documented Angel Drainer abusing queueWithdrawal-style approvals against EigenLayer users in February 2024); OAK-T4.009 (Pre-Token Brand-Anticipation Phishing — structurally adjacent; the October 2024 X-account hijack promoted a fake EigenLayer airdrop).

Attribution

unattributed — multiple pseudonymous phishing operators. The earlier claim of DPRK infrastructure overlap has no supporting source and was removed.

Corrected 2026-10-11

Removed the unsourced "mid-seven-figures" aggregate, named typosquat domains, DPRK-overlap attribution and fabricated campaign waves; anchored the file on the sourced October 2024 EigenLayer X-account hijack (≥$800K from one victim) and Blockaid's February 2024 Angel Drainer queueWithdrawal finding; fixed the EigenLayer launch framing.

Key teaching point

Any protocol with a large "stake now" flow amplified by a points or pre-token incentive program is a phishing surface. The primitive is the same across protocols: the user intends to deposit into a known contract, and a spoofed frontend, hijacked official account, or malicious approval request routes assets to an attacker. Official-account compromise (the October 2024 hijack) lets attackers skip the typosquat step and borrow the protocol's own trust.