Hackers Exploit Ethereum Upgrade to Drain WLFI Tokens

Holders of the World Liberty Financial (WLFI) governance token are reportedly falling victim to a phishing exploit connected to Ethereum’s EIP-7702, according to SlowMist founder Yu Xian.

The issue stems from Ethereum’s Pectra upgrade in May, which introduced EIP-7702. The feature allows external accounts to temporarily function like smart contract wallets by delegating execution rights and enabling batch transactions, aimed at improving user experience.

However, Xian warned in an X post on Monday that hackers are abusing the function to embed malicious delegate addresses within victim wallets. When tokens are later deposited, attackers can instantly drain funds, with WLFI holders now among the affected.

“Another user had multiple WLFI addresses compromised. Reviewing the method, it again involved a 7702 delegate contract exploit, triggered by private key leakage,” Xian explained.

The Donald Trump–backed WLFI token officially launched trading Monday morning, with a total supply of 24.66 billion tokens.

Source: Yu Xian

How it works

In the days leading up to the token’s official debut, an X user reported on Aug. 31 that a friend had their WLFI tokens drained shortly after transferring Ether (ETH), then priced at $4,385, into their wallet.

Responding to the post, SlowMist founder Yu Xian said the incident was a textbook case of the “Classic EIP-7702 phishing exploit.” He explained that once a private key is compromised, attackers can pre-plant a malicious delegate smart contract into the wallet tied to that key, allowing them to seize tokens as soon as funds arrive.

Xian had earlier noted that such private key leaks are most often the result of phishing attacks.

Source: Yu Xian

“As soon as you try to transfer away the remaining tokens in it, such as these WLFI that were thrown into the Lockbox contract, the gas you input will be automatically transferred away,” he said.

Xian advised victims to “cancel or overwrite the malicious EIP-7702 contract with their own” and quickly transfer tokens out of the compromised wallet as a precautionary measure.

Reports of theft have also surfaced in WLFI community forums, where several tokenholders have shared their experiences. A user posting under the handle hakanemiratlas said his wallet was compromised as far back as last October and expressed fears that his WLFI holdings remain at serious risk.

“I was only able to move about 20% of my WLFI tokens into a new wallet,” he explained. “It turned into a stressful race against the hacker— even sending ETH for gas fees felt dangerous, since those funds could have been stolen instantly.”

The user added that the majority of his holdings remain vulnerable. “At the moment, 80% of my WLFI tokens are still locked in the compromised wallet. I’m extremely worried that once they unlock, the hacker will immediately drain them.”

Another community member, using the handle Anton, suggested the problem may be widespread. According to him, many tokenholders face the same risk because of the way the WLFI token drop was designed: wallets used to join the whitelist are the same ones required for presale participation, leaving them more exposed to exploits.

“The instant the tokens arrive, they will be stolen by automated sweeper bots before we have a chance to move them to a secure wallet,” he said.

A user under the handle Anton said people who signed up for the WLFI whitelist and have since had their wallets compromised are in danger of losing their tokens. Source: World Liberty Financial

A surge of WLFI-related scams has emerged both before and after the token’s launch. Analytics firm Bubblemaps reported spotting multiple “bundled clone” contracts designed to mimic legitimate crypto projects and mislead unsuspecting investors.

In response, the WLFI team has issued a warning to its community, stressing that it never reaches out to users through direct messages on any platform. The project emphasized that its only official support channels are via email.

“If you receive a DM claiming to be from us, it is fraudulent and should be ignored,” the team said. “For emails, always verify that the sender’s address belongs to one of our official domains before replying.”