SlowMist: The theft of 1.67 million EIGEN tokens originated from an external malicious attack

SlowMist announced in a post that it was commissioned to investigate independently the recent theft of 1.67 million EIGEN tokens. After a thorough investigation, SlowMist concluded that the incident was caused by an external malicious attack: an investor of Eigen Labs became a victim of a phishing attack, which led to the intrusion of an employee's email account. This allowed the attacker to access the email thread between the investor, Eigen Labs, and the custodian, where they discussed transferring EIGEN tokens to the custodian, who would hold the tokens on behalf of the investor.

EigenLayer reiterated that the incident did not affect its official website, any protocols, or token smart contracts, nor is it related to any on-chain functionality. Its internal investigation includes a thorough review of the token transfer approval process to assess any process errors that led to this incident and determine what improvements are needed to minimize future risks.