Fake Base + OP Stack Superchain L3 sequencer-downtime refund-claim drainer lure — "Base / Superchain sequencer experienced downtime / fault-proof failure — claim refund through bridge.base.org within 48 hours" targeting Base L2 / L3 users who saw real sequencer-downtime news. The drainer prompts a Permit2-style approval at a fake bridge.base.org which gives attackers blank-check token-spend authority. Real Base / OP sequencer-incident refunds (when applicable) flow through native protocol UI on bridge.base.org / optimism.io, never via inbound email link demanding wallet connection. Distinct from `fake-eip-7702-account-abstraction-delegation-lure` (general delegation drainer), `fake-eigenlayer-symbiotic-restaking-slash-recovery-lure` (LRT slash drainer). Bridge-drainer cluster. Source: GC1 R8 multiagent council (S4 crypto specialist).
base-superchain-l3-sequencer-fee-refund-claim-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake Base + OP Stack Superchain L3 sequencer-downtime refund-claim drainer lure targeting Base L2 / L3 users. The phish narrative arrives as: "Base L2 / L3 superchain experienced sequencer downtime — claim your refund through the bridge within 48 hours — connect wallet to claim the reimburse credit," or "OP Stack superchain reported a sequencer fault proof failure — dispute and claim refund via the L2 L3 bridge within 24 hours." Base (Coinbase's L2 on the OP Stack, $5B+ TVL through 2026) + the broader Optimism Superchain (Optimism mainnet, Mode, Zora, Worldcoin, etc.) genuinely experienced sequencer-downtime + fault-proof events through 2025-2026, lending the lure narrative credibility. The drainer prompts the user to connect wallet at a fake `bridge.base.org` and sign a Permit2-style approval — the signed approval gives the attacker blank-check token-spend authority for the duration of the Permit2 deadline (typically maximum-uint256 nonce + far-future expiry), draining every approved ERC-20 token from the wallet on the next attacker-initiated transfer. Real Base / OP sequencer-incident refunds (when applicable) flow through native protocol UI on bridge.base.org / optimism.io with no Permit2 prompt; refund credits arrive automatically against the same wallet address that experienced the downtime, never via inbound email link demanding wallet connection or signature. Compromised wallets see full token-balance loss across every approved ERC-20 (USDC, USDT, DAI, plus DeFi LP tokens, plus governance tokens) — typical retail exposure $500-$50K, institutional exposure $100K-$10M+ depending on bridge usage. Distinct from `fake-eip-7702-account-abstraction-delegation-lure` (general account-abstraction drainer, no L2 / sequencer framing) and `fake-eigenlayer-symbiotic-restaking-slash-recovery-lure` (LRT slash-recovery drainer with restaking-protocol vocabulary) — this signal is specifically the Base / Superchain / OP Stack L3 / sequencer-fee / bridge-refund framing. Bridge-drainer cluster. Fires when body references Base L2 / L3 / superchain / OP Stack / sequencer / L2-L3 bridge / fault proof / Optimism AND contains refund / downtime / claim / dispute / reimburse / connect wallet / action-required urgency. Excludes base.org, bridge.base.org, optimism.io, op.network, superchain.eco, coinbase.com. Auto-classified as danger via the `-lure` suffix. Source: GC1 R8 multi-agent council (S4 crypto specialist).
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started