PancakeSwap LP Loses $2.96M to Malicious EIP-7702 Signature Attack

According to Specter, a long-inactive PancakeSwap liquidity provider lost approximately $2.96 million after signing a malicious EIP-7702 authorization. The attacker removed about $1.48 million in BSC-USD and $1.48 million in BUSD liquidity, then swapped the BUSD to ETH.

Following the theft, the attacker deposited approximately $1.46 million to Tornado Cash, while the remaining $1.48 million in USDT stayed in the attacker's address.