Avg attacker reconnaissance time for peer-class protocols
EigenLayer's assessment for RD-F-163 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
For restaking/LRT-class protocols, reconnaissance patterns vary: Kelp DAO (Lazarus, April 2026) showed pre-funding via Tornado Cash ~10h before exploit (short-cycle reconnaissance); Drift Protocol (DPRK, April 2026) showed 6-day SC governance-weakening pre-strike; USPD-class attacks showed 78-day reconnaissance windows. EigenLayer's October 2024 investor compromise involved sustained email thread monitoring (reconnaissance duration unknown, likely weeks). EigenLayer as the $8.89B TVL foundational restaking layer is a higher-value target than any single LRT. Average reconnaissance time for similar-class peer protocols: 6 to 78 days. Score yellow because the restaking protocol class is now confirmed as an active DPRK targeting priority, elevating the reconnaissance risk baseline for EigenLayer itself.
Sources #
- URLExplained: The EigenLayer Investor Hack October 2024 — HalbornHalborn: October 2024 EigenLayer investor hack — attacker intercepted email thread (sustained monitoring required, duration unknown)retrieved 2026-04-28
- LayerZero blames Kelp's setup — Coindesk April 2026Coindesk/LayerZero: Kelp DAO Lazarus attack preceded by Tornado Cash pre-funding ~10 hours before exploit; pattern matches DPRK operational cadenceretrieved 2026-04-28
- 03-taxonomy.md v1.1 batch-24 and T-09 signal spec §4.9Batch-24 taxonomy F182 rationale: Drift Protocol SC threshold reduction 6 days before $285M DPRK exploit; T-09 §4.9: USPD-class reconnaissance 78 daysretrieved 2026-04-28
Methodology #
Report the average number of days of attacker reconnaissance activity before a strike on peer-class protocols (lending/DEX/bridge/perps), sourced from the hack database.
See the full factor methodology and distribution across all protocols →