Institutional entity lost $2.3M in MORPHO tokens through an EIP-7702 delegation attack, with funds routed to Tornado Cash.
Security & Exploits ·
An institutional entity lost $2.3M in MORPHO tokens through an EIP-7702 delegation attack, with the stolen funds subsequently routed to Tornado Cash. The incident represents a compromise of account delegation permissions under the EIP-7702 standard, which allows temporary code execution without permanent contract upgrades.
EIP-7702 enables addresses to delegate execution authority, a mechanism intended to simplify certain transactions but which created an attack surface in this case. The attacker exploited this delegation pathway to gain control over the victim's MORPHO holdings. This attack follows a prior incident in October involving a $3.5M bridge theft tied to the same entity, suggesting a pattern of security vulnerabilities or targeting.
The investigation into whether additional vulnerabilities remain or whether this represents an isolated exploitation of the delegation mechanism is ongoing. The use of Tornado Cash for fund obfuscation complicates asset recovery efforts. Blockworks reported on the suspected identity and circumstances, while security researchers documented the technical details of the exploit chain.