Key Highlights
- Over $3.55 million in bridged digital assets was drained from a single wallet via Polygon’s Agglayer and NEAR’s Rainbow Bridge in two separate transactions.
- The entity routed transactions using Ethereum’s EIP-7702 delegation framework, funded beforehand via privacy mixer Tornado Cash.
- Prior to the drain, onchain researcher stuckfunds.eth had warned the original wallet owner about the claimable bridge balances.
Multi-Million Dollar Bridge Claim Exploits EIP-7702 Functionality
An externally owned account was drained of approximately $3.55 million in cryptocurrency across two consecutive transactions, onchain data reveals. The coordinated transfers pulled trapped bridge funds through an intermediary wallet, identified as 0x4943, and directed them to a receiving address designated as 0x24a9. The activity capitalized on Ethereum’s EIP-7702 delegation design, which allows external accounts to temporarily delegate transaction execution to smart contracts.
The drain unfolded rapidly during late afternoon trading hours. The initial transaction occurred at 4:13:47 p.m. ET, drawing approximately 499,865 USDT, 325,587 USDC, 500,048 DAI, and 0.9953 ETH from Agglayer. These tokens were funneled through the 0x4943 wallet directly to recipient 0x24a9, totaling an estimated value of $1.33 million. Just over eleven minutes later, at 4:24:59 p.m. ET, a second transfer moved roughly 2.22 million USDT from NEAR Protocol’s Rainbow Bridge through the same intermediary account to 0x24a9. Valuation estimates, compiled by The Defiant, relied on historical token pricing from DefiLlama recorded within one second of the onchain timestamps.
Anatomy of the Exploit: Delegation and Gas Relay Mechanics
Preparations for the transfers began earlier in the afternoon. At 3:32:59 p.m. ET, address 0x24a9 received a seed transaction of roughly 0.09783 ETH sourced directly from Tornado Cash’s 0.1 ETH privacy pool. This initial balance provided the gas required to submit the subsequent claims and execute the asset sweeps.
Under EIP-7702 specifications, standard externally owned accounts (EOAs) can authorize smart-contract code to execute actions in their own context. This structure permits a third-party relayer to pay network gas fees while executing cryptographically signed authorizations issued by the target account. While block explorer Etherscan verified both delegation authorizations as cryptographically valid, this technical validity alone does not confirm who possessed the underlying signing key or whether the transactions were authorized by the original owner.
Multiliquid Raises $8 Million to Boost Liquidity in $40 Billion Tokenized Asset Market
Notably, the vulnerability of the funds had been flagged days prior. On October 4, onchain researcher stuckfunds.eth transmitted a direct message alerting the owner of 0x4943 to the uncollected balances sitting across the bridge protocols. “Claim it yourself from this wallet,”
the message instructed. Following the extraction of the Rainbow Bridge assets, 0x24a9 submitted an immediate follow-up transaction within the same Ethereum block to revoke the EIP-7702 delegation for wallet 0x4943, effectively cutting off further automated interactions.
Why This Matters
The incident highlights the operational nuances and potential attack surfaces introduced by account abstraction standards like EIP-7702. While delegation mechanisms are designed to improve user experience by enabling gas sponsorship and flexible batching, they also introduce complex trust assumptions. When private keys or signed authorization messages are exposed, third-party relayers can drain uncollected protocol balances without requiring the underlying wallet to hold native ETH for gas. As cross-chain infrastructure and account delegation adoption grow, safeguarding uncollected bridge assets and managing active delegation permissions will remain a critical priority for crypto security analysts and protocol developers.
Frequently Asked Questions
What is EIP-7702 and how was it used in this incident?
EIP-7702 is an Ethereum standard allowing standard private-key wallets (EOAs) to temporarily delegate their execution context to smart contracts. In this case, address 0x24a9 used signed delegations to submit bridge claims and move funds through wallet 0x4943 while covering the network gas fees itself.
Which bridges and tokens were involved in the drain?
The transfers involved Agglayer and NEAR’s Rainbow Bridge. The drained assets included approximately 499,865 USDT, 325,587 USDC, 500,048 DAI, and 0.9953 ETH from Agglayer, alongside 2.22 million USDT extracted from the Rainbow Bridge.
Were the bridge protocols themselves compromised?
The incident stemmed from the execution of valid claim permissions and account delegation on Ethereum, rather than a direct smart-contract vulnerability or exploit within Agglayer or the Rainbow Bridge systems.
