Worked example · 2024

EigenLayer token-anticipation phishing campaign — 2024

Loss

The one documented event is the 2024-10-18 hijack of EigenLayer's official X account, which promoted a fake EIGEN season-2 "reallocation" airdrop link; ScamSniffer reported at least one victim lost $800K (in mETH), with other reports putting total losses at $800K-$1M. This is after the EIGEN token launch (2024-05-10), not in the pre-token window. No source in this file documents the typosquat-domain campaign during June 2023 - May 2024; that earlier description was unverified.

OAK Techniques observed

OAK-T4.009 (Pre-Token Brand Anticipation Phishing). EigenLayer's restaking-points programme (which accrued "points" to early restakers with a publicly signalled future conversion to EIGEN tokens) created an even larger T4.009 surface than a standard token announcement — the points programme gave the anticipation phishing a concrete "check your points balance" hook that victims had been conditioned to expect.

Attribution

unattributed — the phishing infrastructure has not been publicly attributed to a specific actor at v0.1 cutoff.

Key teaching point

EigenLayer's points programme demonstrates an anticipation-driven sub-pattern: when a protocol runs a points/airdrop programme, the expectation of further distributions creates a legitimate user behaviour (checking points, calculating expected airdrop) that phishing domains can mimic with high fidelity. The user has been conditioned by the protocol to expect a future claim event — the attacker supplies a fake one.

Corrected 2026-10-11

Documented event restated as the 2024-10-18 EigenLayer X-account hijack (post token launch); the invented typosquat domains and claims-portal URL were removed and the pre-token-window claim marked unverified.