$3.55 Million in Unclaimed Bridge Funds Moved via EIP-7702

An address funded through Tornado Cash claimed and transferred roughly $3.55 million in previously unclaimed bridge assets through Ethereum wallet 0x4943 on Oct. 9, using two EIP-7702 account delegations.

BlockSec Phalcon, which flagged the transfers, said the onchain record confirms valid authorizations, “but not whether the owner signed them intentionally, was tricked into signing them, or had the private key compromised.”

The transaction records show assets arriving from Agglayer and $NEAR’s Rainbow Bridge at 0x4943, then leaving for 0x24a9 within the same respective transactions. The recipient, 0x24a9, submitted both transactions.

The first transaction, at 4:13:47 p.m. ET, moved approximately 499,865 $USDT, 325,587 USDC, 500,048 DAI and 0.9953 $ETH from Agglayer through the wallet to 0x24a9. Those assets were worth about $1.33 million.

The second transaction, at 4:24:59 p.m. ET, moved about 2.22 million $USDT from $NEAR’s Rainbow Bridge through the same wallet to the same recipient, worth approximately $2.22 million.

The Defiant calculated the dollar estimates using onchain token quantities and DefiLlama historical prices at or within one second of the transaction timestamps.

An earlier funding transaction, at 3:32:59 p.m. ET that day, sent about 0.09783 $ETH to 0x24a9 from Tornado Cash’s 0.1 $ETH pool.

What the Delegations Allowed

EIP-7702 lets an externally owned account—a wallet controlled by a private key—delegate execution to smart-contract code. A separate address can submit a transaction carrying the account’s signed authorization and pay its gas fees, while the delegated code executes in the authorizing wallet’s context.

That mechanism allowed 0x24a9 to execute the claims and transfers through 0x4943. Etherscan marks both delegation authorizations as valid. Their cryptographic validity does not establish who controlled the signing key or whether the wallet owner intended the transfers.

Days before the funds moved, onchain researcher stuckfunds.eth sent an Oct. 4 message telling the wallet’s owner that funds remained claimable from the two bridges. “Claim it yourself from this wallet,” the message said.

A further transaction, also submitted by 0x24a9, cleared 0x4943’s delegation immediately after the Rainbow Bridge claim in the same Ethereum block.