An investor's privately placed WLFI was completely stolen after a private key leak was exploited by an EIP-7702 phishing attack.

Jinse Finance reported that SlowMist's Cosine disclosed on the X platform that an investor lost all WLFI tokens participated in a private placement due to private key leakage. He stated that this was a classic EIP-7702 phishing exploit. First, the private key was leaked, and the phishing group (possibly more than one) set up an EIP-7702 exploit mechanism for the wallet address corresponding to the victim's private key. This mechanism would "automatically" transfer away any Gas sent in when attempting to transfer the remaining tokens, such as the WLFI tokens locked in the Lockbox contract. The frontrunning approach is feasible: send in Gas, cancel or replace the ambushed EIP-7702 with your own, and transfer away the valuable tokens. These three actions are packaged and sent in one block using flashbots.