# Account-Delegation and Reserve-Manipulation Exploits Fill the Latest DeFi Attack Ledger

Security researchers published reproductions of three fresh incidents, including a token drained through Ethereum's new account-delegation standard. Bridge key compromises remain the costliest category.

- Published: 2026-08-05T05:31:30.193Z
- Canonical: https://polylog.news/crypto/2026-08-05/account-delegation-and-reserve-manipulation-exploits-fill-th
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c25c91d221d2b5204f946e66e97601009a4f6bcb), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/d9bcd648ae761ffc3c7cbda129593c5e5269cf21), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/72e1dfad54e16700b30b1880cf2751aa8db3e27c), [Rekt News](https://www.rekt.news/)

Overnight the security repository DeFiHackLabs added working reproductions of three recent attacks. Each vector is worth naming, because each maps to a known class of failure.

The first drained the MOKE token through [an unprotected claim function reached via EIP-7702 self-delegation](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/c25c91d221d2b5204f946e66e97601009a4f6bcb). Ethereum Improvement Proposal 7702 (EIP-7702) lets an ordinary wallet address temporarily execute contract code. When a distribution function checks only that the caller appears to be a contract, or fails to check who the caller is at all, delegation lets an attacker use that missing access control to withdraw tokens. Security firms have already documented [more than 97 percent of observed EIP-7702 delegations pointing at wallet-draining contracts](https://threesigma.xyz/blog/opsec/ai-phishing-wallet-drainers-eip7702-part-2), so the standard's abuse surface is established rather than theoretical.

The second reproduction covers [an AIC trading-pair skim and reserve-mismatch attack financed by a flash swap](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/d9bcd648ae761ffc3c7cbda129593c5e5269cf21). The pattern is the same one [DARKNAVY documented on BNB Chain in June](https://www.darknavy.org/web3/exploits/dip-token-double-transfer-reserve-manipulation/), where a token transfer bug let an attacker use the pool's own skim and sync functions to zero out a reserve and change the reported price before selling into a second pool. The third, against LpdFi, is [spot-price manipulation combined with an issue-boundary error](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/72e1dfad54e16700b30b1880cf2751aa8db3e27c), meaning the protocol priced an asset from a pool an attacker could move within a single transaction.

The larger sums this cycle came from key and validator compromise rather than contract logic. [Rekt News](https://www.rekt.news/) case files cover AFX Trade, a perpetuals venue on Arbitrum drained of [$24.15 million in USDC after five hot validator signatures on its custody bridge were compromised](https://www.coindesk.com/tech/2026/07/23/arbitrum-based-afx-trade-drained-of-usd24-million-after-bridge-keys-compromised), which bypassed the quorum requirement. The files also cover VerusCoin's Ethereum bridge, where an attacker used the import path to trigger payouts of roughly $7.54 million that no reserves backed. Ostium, another Arbitrum perpetuals venue, lost funds when an attacker fed its custom price layer a bitcoin price of $5,000 to open a position and closed it near $60,000. None of these protocols has reported recovered funds or an identified attacker.

## What this means

Two loss channels are operating side by side, and they call for different defenses. Contract-logic failures, including missing access control and manipulable spot prices, are caught by audits and invariant testing, and they mostly hit small-cap tokens and their holders. Bridge and validator key compromise is an operations and custody problem, it produces the eight-figure losses, and it falls on users who never interacted with a vulnerable contract at all. The addition of EIP-7702 delegation to the techniques available to attackers means contracts written before the standard existed now face a caller type their authors never modeled.

## What to watch

- Whether major lending and perpetuals protocols publish audits specifically covering EIP-7702 delegated callers, which would show the industry has absorbed the new caller model.
- Whether any bridge operator moves signing keys into hardware or threshold schemes after the AFX Trade compromise, since repeat quorum bypasses would suggest custody practice has not changed.
- Whether stolen funds from these incidents are frozen at exchange deposit points, which is now the main recovery route once coins leave a protocol.