Approximately $3.55 million in unclaimed bridge funds has been transferred by an address funded through Tornado Cash using two EIP-7702 delegations. The transaction successfully claimed and moved the assets through valid authorization mechanisms enabled by the new standard. BlockSec stated that while the authorizations used in the transfer are technically valid, this does not establish the wallet owner’s intent regarding the movement of funds. The incident highlights potential security considerations surrounding EIP-7702 delegation capabilities and the distinction between protocol-level validity and user authorization.