Attackers gained access to email communications about investor token custody, then impersonated the legitimate party to direct EigenLayer team to send 1.67M EIGEN tokens to an attacker-controlled address. The tokens were swapped and moved to CEXs.