Reports are circulating that approximately 973,000 MORPHO tokens, worth around $2.3 million, were stolen, but the available information does not yet prove that the Morpho protocol was attacked.
Two brief reports repeat the same claim about an institution suffering a theft. The figures match, but they do not count as two independent verifications. Another postmortem says the attacker set up an EIP-7702 delegation for the victim’s address, transferred the tokens, and then revoked the delegation. For now, this account of the transaction remains an unverified claim from a single source.
My view is that we should distinguish between “a token holder’s address being compromised” and “a lending protocol having a security issue.” The material provided contains no transaction hash that can be independently checked, is insufficient to determine how the signature was obtained, and cannot be used to infer whether protocol funds were affected.
The next step is to see whether the on-chain transactions match the delegation and transfers described, and whether Morpho confirms that any related protocol or vault was affected. If it turns out that only a token holder’s address was compromised, should the market still count this as a protocol risk for MORPHO?
Two brief reports repeat the same claim about an institution suffering a theft. The figures match, but they do not count as two independent verifications. Another postmortem says the attacker set up an EIP-7702 delegation for the victim’s address, transferred the tokens, and then revoked the delegation. For now, this account of the transaction remains an unverified claim from a single source.
My view is that we should distinguish between “a token holder’s address being compromised” and “a lending protocol having a security issue.” The material provided contains no transaction hash that can be independently checked, is insufficient to determine how the signature was obtained, and cannot be used to infer whether protocol funds were affected.
The next step is to see whether the on-chain transactions match the delegation and transfers described, and whether Morpho confirms that any related protocol or vault was affected. If it turns out that only a token holder’s address was compromised, should the market still count this as a protocol risk for MORPHO?