Wintermute: A malicious contract warning code of "CrimeEnjoyor" has been created to alert your Ethereum wallet if it is potentially attacked
PANews reported on June 2 that, according to Cointelegraph, crypto market maker Wintermute said that it had created a code that injected warnings into the verified "CrimeEnjoyor" malicious contract, and that Ethereum users would receive warnings if they encountered a potential attack that could drain their wallet funds. It is reported that the warning statement message said: "Criminals are using malicious contracts to automatically execute ETH transactions, please do not send any ETH". Wintermute added that the EVM bytecode has now been reversed into human-readable Solidity code and publicly verified.
Previously, Wintermute pointed out that since the Ethereum Pectra upgrade and launch EIP-7702, a large number of malicious contracts called "CrimeEnjoyor" have appeared, using the mechanism of users to authorize wallet permissions to smart contracts to try to scan and transfer funds, but the attackers have not profited so far. More than 97% of EIP-7702 authorizations point to the same copy code, which is suspected to be an automatic coin theft tool. The attacker invested about 2.88 ETH for 79,000 address authorizations, and the largest address processed more than 52,000 authorizations, but there has been no actual income so far. Although this attack method did not work, it exposed the security risks of EIP-7702.