Institutional Whale Loses $2.3 Million in MORPHO Token Exploit

Prominent on-chain investigator ZachXBT has reported a significant security breach targeting an institutional entity, resulting in the theft of 973,000 MORPHO tokens. The stolen assets, valued at approximately $2.3 million at current market rates, were drained from two separate addresses within a short timeframe on October 21, 2024. Following the exploit, the perpetrator moved the illicit proceeds into the decentralized privacy protocol Tornado Cash to obfuscate the transaction trail.

Exploitation of EIP-7702 and On-Chain Patterns

The methodology behind the theft involved the use of EIP-7702 account delegation transactions. This specific Ethereum Improvement Proposal allows an Externally Owned Account (EOA) to temporarily function as a smart contract wallet during a transaction, a feature designed to enhance account abstraction but one that can be leveraged by malicious actors if permissions are compromised.

ZachXBT’s technical analysis revealed a troubling pattern of recurring security lapses for the affected party:

• On October 9, the same entity reportedly lost $3.5 million in a previous incident.
• The funds from the earlier theft were recovered from a legacy cross-chain bridge.
• The attacker utilized NEAR Intents to bridge assets from the Ethereum mainnet to Zcash.
• The trail eventually led to the Ironwood privacy pool, further complicating recovery efforts.

Potential Links to Nima Capital

The investigation has uncovered significant links between the victim's wallet and established venture capital firms. According to the on-chain data, one of the compromised addresses shares a direct association with a wallet suspected to belong to Nima Capital. Nima Capital has previously faced scrutiny in the crypto community following a sudden liquidity withdrawal from the Synapse protocol in late 2023, which led to a sharp decline in the value of the SYN token.

The recurring nature of these attacks suggests a persistent vulnerability in the institution's operational security or a targeted campaign by a sophisticated threat actor. ZachXBT noted the complexity of the movement of funds:

These assets were claimed from an old cross-chain bridge, then bridged from Ethereum to Zcash via NEAR Intents, and entered the Ironwood privacy pool.

The incident underscores the ongoing risks associated with high-value institutional holdings in the DeFi ecosystem. As the Morpho Blue protocol continues to grow, the security of individual account delegations remains a critical point of failure. Investors are advised to review their EIP-7702 permissions and utilize multi-signature hardware solutions to mitigate the risk of unauthorized account delegation.