Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization
A PancakeSwap liquidity provider (BNB Chain)
A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.
Why this severity: $3.0M reported stolen, 1 victims.
- Started
- Jul 23, 2026
- Closed
- Jul 23, 2026
- Chains
- BNB Chain
- Reported stolen
- $3.0M
- Victims
- 1
At risk
- A PancakeSwap liquidity provider (BNB Chain)
- BNB Chain wallets
What to do now
- Move remaining assets, including LP positions, to a new wallet that has never signed a 7702 authorization.
- Clear the delegation (set it back to the zero address) from a trusted wallet if your wallet supports it.
Stay safe
Am I affected?
Check whether your address has an EIP-7702 delegation set (block explorers show a 'delegated to' contract on the address page). If it points to a contract you did not choose, assume the wallet is compromised.
What to do now
- Move remaining assets, including LP positions, to a new wallet that has never signed a 7702 authorization.
- Clear the delegation (set it back to the zero address) from a trusted wallet if your wallet supports it.
How to avoid this
- Only accept account 'upgrades' or 'smart account' prompts from inside your own wallet app, never from a website.
- Use a wallet that blocks or loudly warns on third-party EIP-7702 authorization requests.
- Keep long-term LP and treasury funds in a wallet you do not connect to new sites.
Timeline 1
Specter reports a dormant PancakeSwap LP lost about $2.96M after signing a malicious EIP-7702 authorization; about $1.46M goes to Tornado Cash.
Source
News & write-ups ›1
How this method works
Since Ethereum's Pectra upgrade, a normal wallet can delegate itself to smart-contract code. Sign a malicious delegation and that code can do anything with your wallet. Read about eip-7702 delegation phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.