Phishing Exploit Targets World Liberty Financial Tokenholders Amid Ethereum Upgrade

According to Cointelegraph, World Liberty Financial’s (WLFI) governance tokenholders are facing a phishing wallet exploit linked to Ethereum’s EIP-7702 upgrade, as reported by SlowMist founder Yu Xian. The Ethereum Pectra upgrade in May introduced EIP-7702, which allows external accounts to temporarily function like smart contract wallets, enabling batch transactions to enhance user experience. However, hackers are exploiting this upgrade by embedding a hacker-controlled address in victim wallets. When a deposit is made, they swiftly seize the tokens, impacting WLFI tokenholders. Xian highlighted in a post on X that multiple addresses holding WLFI tokens were compromised through the 7702 delegate malicious contract, with private key leakage being a prerequisite. The Donald Trump-backed World Liberty Financial token began trading with a total supply of 24.66 billion tokens. Prior to the official launch, an X user reported that a friend’s WLFI tokens were drained after transferring Ether (ETH) into their wallet. Xian confirmed this as a "Classic EIP-7702 phishing exploit," where the private key was leaked, allowing a delegate smart contract to be pre-planted into the victim’s wallet address. Xian suggested canceling or replacing the ambushed EIP-7702 and transferring tokens from compromised wallets as potential solutions. In the WLFI forums, users have reported similar issues. One user, hakanemiratlas, expressed concern after managing to transfer only 20% of their WLFI tokens to a new wallet, fearing the remaining 80% could be stolen once unlocked. Another user, Anton, noted that many others face similar issues due to the token drop implementation, where the wallet used to join the WLFI whitelist must be used for the presale. Anton requested the WLFI Team to consider a direct transfer option for tokens to prevent automated sweeper bots from stealing them upon arrival. Scammers have targeted the WLFI token launch, with analytics firm Bubblemaps identifying several "bundled clones" that mimic established crypto projects. The WLFI team has warned users that they do not contact via direct message on any platform, with official support only available through email. They advised users to verify the authenticity of emails by checking the official domains before responding. The team emphasized that any direct messages claiming to be from them are fraudulent and should be ignored.