Worked example · 2024

EigenLayer token-anticipation phishing campaign — 2024

Loss

Per-victim loss, not a single-incident total. During EigenLayer's pre-token window (mainnet launch June 2023 through EIGEN token deployment May 2024), attackers registered typosquat domains combining "eigenlayer" or "eigen" with airdrop/claim/token/launch keywords and deployed fake "EIGEN airdrop claim" UIs targeting EigenLayer restakers and LRT depositors.

OAK Techniques observed

OAK-T4.009 (Pre-Token Brand Anticipation Phishing). EigenLayer's restaking-points programme (which accrued "points" to early restakers with a publicly signalled future conversion to EIGEN tokens) created an even larger T4.009 surface than a standard token announcement — the points programme gave the anticipation phishing a concrete "check your points balance" hook that victims had been conditioned to expect.

Attribution

unattributed — the phishing infrastructure has not been publicly attributed to a specific actor at v0.1 cutoff.

Key teaching point

EigenLayer's points programme demonstrates an amplified T4.009 sub-pattern: when a protocol runs a points/credits programme during the pre-token window, the points-to-token conversion expectation creates a legitimate user behaviour (checking points, calculating expected airdrop) that phishing domains can mimic with high fidelity. The user has been conditioned by the protocol to expect a future claim event — the attacker supplies a fake one.