PancakeSwap LP Loses $2.96 Million After Signing Malicious EIP-7702 Authorization

A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization. According to Odaily, the attacker removed about $1.48 million in BSC-USD and $1.48 million in BUSD liquidity supplied by the victim, then swapped the BUSD for ETH. The attacker has since deposited about $1.46 million into Tornado Cash, while the remaining about $1.48 million in USDT is still held in the attacker’s address.