WLFI holders targeted in Ethereum-based phishing exploit shortly after trading launch

Investors in World Liberty Financial (WLFI) are facing more than just price declines a day after the token began trading. Hackers have been exploiting a vulnerability linked to Ethereum’s recent Pectra upgrade, siphoning WLFI tokens through what security experts describe as a “classic EIP-7702 phishing exploit.”

WLFI, the Donald Trump–affiliated governance token, launched Monday with a total supply of 24.6 billion and underpins an ecosystem of branded payment cards and services. The token initially spiked to 33.13 cents but has since fallen to 24.27 cents, according to CoinGecko.

The attack stems from EIP-7702, introduced in May to allow standard wallets to operate like smart contract wallets for batch transactions. While intended to enhance user experience, the feature has created a loophole that allows attackers to embed malicious delegate contracts within compromised wallets. Once a victim deposits ETH or tokens, the contract automatically reroutes the funds to hacker-controlled addresses.

SlowMist founder Yu Xian flagged the vulnerability on Monday, confirming multiple WLFI wallets were drained using the method. “As soon as you try to transfer the remaining tokens, the gas you input will be automatically transferred away,” he said, adding that phishing attacks leading to private key leaks remain the primary entry point.

WLFI community members are attempting to salvage their holdings. One user reported successfully moving only 20% of their tokens to a secure wallet, with the remainder trapped in compromised addresses.

The exploit comes amid a surge of scams coinciding with WLFI’s trading debut. Analytics firm Bubblemaps highlighted “bundled clones” impersonating WLFI contracts, while phishing links continue circulating on platforms such as Telegram and X.