Analysis of "12,000 spWETH stolen from a certain address": Hackers induce users to pre-generate non-transaction addresses and create contracts through Permit offline authorization

Odaily News According to official news, through analysis by the OKX Web3 security team, yesterday a certain address lost more than 12,000 spWETH due to phishing. The hacker induced the user to authorize a pre-generated non-transaction address offline through Permit, and then created a contract on the address through Create2 to transfer assets. For this scenario, OKX Wallet will automatically identify the signature of this type of address as an EOA address and prompt it. OKX Web3 will continue to improve its security risk detection capabilities.