Lumi Finance — ERC-4337 UserOp Validation Side-Effect Drain (Sodium Smart Accounts)

Timeline: ~4 days pre-attack: attacker EOA 0xCe1a3BB0... funded from FixedFloat 2 (no-KYC exchange) in methodical preparation pattern comparable to Cascade rehearsals. July 13, 2026 ~13:53 UTC: primary exploit tx 0x020995ec... executed at block 483390715 on Arbitrum. In one atomic transaction, the attacker exploits Sodium smart accounts by controlling a malicious paymaster that obtains ERC-20 allowances from 50+ smart accounts through validation-time side effects (a violation of ERC-4337 spec that requires strict separation between validation and execution). The paymaster silently gets approvals during validateUserOp() without any explicit user signature or key compromise. The sweeper contract 0x56362412... batch-drains LUA, LUAUSD, USD₮0, USDC, USDC.e from the compromised accounts, then swaps stables to WETH within the same tx. Blockaid detects and posts the alert (tweet 2076621100872614069, 13:53 UTC). Follow-up tweet 2076621683817873639 (13:55 UTC) publishes the attacker address and tx hash. SlowMist TI Alert relays the alert with a slightly different USD figure (~$264K). Post-exploit (July 13-17): attacker laundering path — Approve + Withdraw WETH to ETH, 6 consecutive 1 ETH deposits + smaller amounts to 0x0D5550d5... (typical mixer/bridge deposit pattern), KyberSwap Meta Aggregation Router v2 used to resell LUA/LUAUSD tokens over the following days, ETH deposits to 0x10D8b8Da... Final EOA balance ~0.0288 ETH by July 17 — attacker offloaded nearly everything within 4 days. No official post-mortem or compensation plan from Lumi Finance as of report date.