$2.3M MORPHO Theft Exposes EIP-7702 Delegation Risks

On October 21, on-chain investigator ZachXBT revealed a coordinated attack targeting two addresses belonging to an institution, resulting in the loss of 973,000 MORPHO tokens valued at approximately $2.3 million. The stolen funds were quickly routed into privacy-enhancing protocols after extraction, complicating recovery efforts.

Attack Vector Analysis: EIP-7702 Authorization Exploited

ZachXBT's trace data indicates both compromised addresses were breached through EIP-7702 account delegation transactions. This emerging account abstraction standard allows temporary external control of accounts—designed for user experience improvements but now revealing critical security gaps.

  • Attackers exploited delegation permissions to drain MORPHO holdings during authorized periods
  • Fund movement patterns suggest organized operations rather than random targeting
  • Stolen tokens were rapidly dispersed through multiple intermediary addresses

Cross-Chain Laundering Trail: From Ethereum to Privacy Pools

Deeper investigation uncovered that one victim address was involved in a prior incident. The same entity suffered a $3.5 million loss on October 9, with those assets originating from old bridge claims.

Those earlier funds followed a sophisticated path: bridged from Ethereum to Zcash via NEAR Intents, then channeled into the Ironwood privacy pool. This cross-chain + privacy protocol combination has become a standard laundering methodology for sophisticated attackers.

On-Chain Connections: Potential Venture Capital Links

ZachXBT's report highlighted another significant finding: the victim address shows clear on-chain interactions with an address suspected to belong to Nima Capital. While entity confirmation remains pending, this connection provides investigators with a valuable lead.

Industry observers note that institutional addresses increasingly face targeted attacks, revealing systemic vulnerabilities in DeFi security frameworks. Scenarios involving account abstraction and cross-chain interactions particularly demand enhanced multisignature controls and monitoring.

This incident reinforces that as standards like EIP-7702 gain adoption, projects must reassess risk boundaries within delegation models. Relying solely on smart contract audits is insufficient—real-time monitoring and anomalous behavior detection have become equally critical.