{"success":true,"data":{"id":"base-superchain-l3-sequencer-fee-refund-claim-lure","label":"Fake Base + OP Stack Superchain L3 sequencer-downtime refund-claim drainer lure — \"Base / Superchain sequencer experienced downtime / fault-proof failure — claim refund through bridge.base.org within 48 hours\" targeting Base L2 / L3 users who saw real sequencer-downtime news. The drainer prompts a Permit2-style approval at a fake bridge.base.org which gives attackers blank-check token-spend authority. Real Base / OP sequencer-incident refunds (when applicable) flow through native protocol UI on bridge.base.org / optimism.io, never via inbound email link demanding wallet connection. Distinct from `fake-eip-7702-account-abstraction-delegation-lure` (general delegation drainer), `fake-eigenlayer-symbiotic-restaking-slash-recovery-lure` (LRT slash drainer). Bridge-drainer cluster. Source: GC1 R8 multiagent council (S4 crypto specialist).","description":"Fake Base + OP Stack Superchain L3 sequencer-downtime refund-claim drainer lure targeting Base L2 / L3 users. The phish narrative arrives as: \"Base L2 / L3 superchain experienced sequencer downtime — claim your refund through the bridge within 48 hours — connect wallet to claim the reimburse credit,\" or \"OP Stack superchain reported a sequencer fault proof failure — dispute and claim refund via the L2 L3 bridge within 24 hours.\" Base (Coinbase's L2 on the OP Stack, $5B+ TVL through 2026) + the broader Optimism Superchain (Optimism mainnet, Mode, Zora, Worldcoin, etc.) genuinely experienced sequencer-downtime + fault-proof events through 2025-2026, lending the lure narrative credibility. The drainer prompts the user to connect wallet at a fake `bridge.base.org` and sign a Permit2-style approval — the signed approval gives the attacker blank-check token-spend authority for the duration of the Permit2 deadline (typically maximum-uint256 nonce + far-future expiry), draining every approved ERC-20 token from the wallet on the next attacker-initiated transfer. Real Base / OP sequencer-incident refunds (when applicable) flow through native protocol UI on bridge.base.org / optimism.io with no Permit2 prompt; refund credits arrive automatically against the same wallet address that experienced the downtime, never via inbound email link demanding wallet connection or signature. Compromised wallets see full token-balance loss across every approved ERC-20 (USDC, USDT, DAI, plus DeFi LP tokens, plus governance tokens) — typical retail exposure $500-$50K, institutional exposure $100K-$10M+ depending on bridge usage. Distinct from `fake-eip-7702-account-abstraction-delegation-lure` (general account-abstraction drainer, no L2 / sequencer framing) and `fake-eigenlayer-symbiotic-restaking-slash-recovery-lure` (LRT slash-recovery drainer with restaking-protocol vocabulary) — this signal is specifically the Base / Superchain / OP Stack L3 / sequencer-fee / bridge-refund framing. Bridge-drainer cluster. Fires when body references Base L2 / L3 / superchain / OP Stack / sequencer / L2-L3 bridge / fault proof / Optimism AND contains refund / downtime / claim / dispute / reimburse / connect wallet / action-required urgency. Excludes base.org, bridge.base.org, optimism.io, op.network, superchain.eco, coinbase.com. Auto-classified as danger via the `-lure` suffix. Source: GC1 R8 multi-agent council (S4 crypto specialist).","tier":"danger","category":"other","isThin":false}}