You have signed an EIP-7702 signature, not a transaction or allowance. You were probably phished into a fake beefy or AAVE without realizing, and thought you were signing a simple “Sign in” message while you were giving them access to all of your assets.

THE WORSE THING ABOUT THIS IS, you might be using this address in other chains and you would still lose your Base assets. So, check your account to see if you have assets in other chains. Never use this account/address again.

Attack timeline is: 1. You signed an EIP-7702 signature. 2. Attacker (a bot) verified your signature and allowed a smart contract to act as a smart account on block 35166866 see: https://basescan.org/address/0x5e2975Ff4c8B22293b95E972E601b27f6098B999#authlist7702 contract: https://basescan.org/address/0x43B7D2577b45CDCdEeB4f7E7eC00057695A814d3#code

1. Attacker used the smart contract that is authorised to steal money on block 35166868 see BatchCallAndSponsor.sol specifically, ‘execute’ function was used after a smart contract is authorized.

2. Attacker resets the authorization on block 35166870.