{
 "slug": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
 "title": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
 "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026",
 "json": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "bsc"
 ],
 "method": "eip-7702-phishing",
 "product": "A PancakeSwap liquidity provider (BNB Chain)",
 "tags": [
  "bsc",
  "eip-7702-phishing",
  "eip-7702",
  "pancakeswap",
  "liquidity-provider",
  "tornado-cash",
  "specter"
 ],
 "amountUsd": 2960000,
 "victims": 1,
 "startedAt": "2026-07-23",
 "closedAt": "2026-07-23",
 "updatedAt": "2026-07-23T12:00:00Z",
 "summary": "A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.",
 "timeline": [
  {
   "date": "2026-07-23",
   "title": "Specter reports a dormant PancakeSwap LP lost about $2.96M after signing a malicious EIP-7702 authorization; about $1.46M goes to Tornado Cash.",
   "sourceUrl": "https://www.chaincatcher.com/en/article/2277886"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "A long-inactive PancakeSwap LP lost about $2.96 million after signing a malicious EIP-7702 authorization",
   "url": "https://www.chaincatcher.com/en/article/2277886",
   "publisher": "ChainCatcher",
   "date": "2026-07-23"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nCheck whether your address has an EIP-7702 delegation set (block explorers show a 'delegated to' contract on the address page). If it points to a contract you did not choose, assume the wallet is compromised.\n\n## What to do now\n- Move remaining assets, including LP positions, to a new wallet that has never signed a 7702 authorization.\n- Clear the delegation (set it back to the zero address) from a trusted wallet if your wallet supports it.\n\n## How to avoid this\n- Only accept account 'upgrades' or 'smart account' prompts from inside your own wallet app, never from a website.\n- Use a wallet that blocks or loudly warns on third-party EIP-7702 authorization requests.\n- Keep long-term LP and treasury funds in a wallet you do not connect to new sites.",
 "notes": null,
 "agentBrief": "# Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization\n\n- Severity: Critical · Status: Contained (past)\n- Chains: BNB Chain · Method: EIP-7702 delegation phishing\n- Started: Jul 23, 2026 · Last update: Jul 23, 2026 · Reported stolen: $3.0M · Victims: 1\n- Who/what: A PancakeSwap liquidity provider (BNB Chain)\n\nA long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.\n\n## Am I affected?\nCheck whether your address has an EIP-7702 delegation set (block explorers show a 'delegated to' contract on the address page). If it points to a contract you did not choose, assume the wallet is compromised.\n\n## What to do now\n- Move remaining assets, including LP positions, to a new wallet that has never signed a 7702 authorization.\n- Clear the delegation (set it back to the zero address) from a trusted wallet if your wallet supports it.\n\n## How to avoid this\n- Only accept account 'upgrades' or 'smart account' prompts from inside your own wallet app, never from a website.\n- Use a wallet that blocks or loudly warns on third-party EIP-7702 authorization requests.\n- Keep long-term LP and treasury funds in a wallet you do not connect to new sites.\n\n## Sources\n- A long-inactive PancakeSwap LP lost about $2.96 million after signing a malicious EIP-7702 authorization (ChainCatcher, 2026-07-23): https://www.chaincatcher.com/en/article/2277886\n\nFull record: https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026 · JSON: https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}