Eigenlayer
Summary
EigenLayer is a legitimate Ethereum restaking protocol operated by Eigen Labs that became a high-value target for phishing campaigns, wallet drainer attacks, and social engineering in 2024 following the launch of its EIGEN token. In October 2024 alone, the protocol's official X account was compromised to promote a fake airdrop resulting in at least $800,000 lost by one victim, and a separate email-based social engineering attack redirected approximately $5.7 million in locked investor tokens to an attacker's wallet. EIGEN holders and restakers face an elevated and persistent threat surface from impersonation sites, fake airdrop claims, and token-approval drainer schemes that exploit the protocol's name and brand recognition.
Connected Entities
1 entitiesTimeline(6 events)
2024-05-10
EigenLayer begins EIGEN token airdrop (Season 1 stakedrop); employees and investors subject to one-year lockup period.
2024-10-04
EigenLayer announces investigation into unauthorized sale of approximately 1,673,645 EIGEN tokens (~$5.7M) from wallet 0x87787389BB2Eb2EC8Fe4aA6a2e33D671d925A60f, later attributed to a social engineering attack on an investor email thread.
2024-10-04
Lookonchain and Arkham Intelligence trace the suspicious EIGEN token sale to EigenLayer team wallet; ZachXBT credited in subsequent investigation announcement.
2024-10-18
EigenLayer's official X account is compromised; attackers post fraudulent EIGEN Season 2 airdrop announcements linking to phishing site blog.eigenfoundation.org. ZachXBT issues Telegram alert warning users not to click any links.
Research Gaps
1 open · agent-resolvableHeuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.
- [med]unarchived sources
Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.
Decision Log
- hash: FPgNm4k3d1AzfRLPNQVaqzYaVRZSKrgqq7on6bnPC1fF
- hash: C71RJi3fJpGYBwacA5zbbyH7oVFo7TKpsxv8gsAFPSMZ
- hash: DCEyfZHWt58BrcBJRsLAdLxzPJSo7kFpDmjkZ5SoiaY5
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet
generated: 5/4/2026, 4:04:59 PM
last updated: 6/14/2026, 11:15:50 PM
avoid.net — verified advice for a post-truth world