{
 "slug": "eip-7702-delegation-drain-22k-oct-2026",
 "title": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
 "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026",
 "json": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026.json",
 "status": "live",
 "severity": "medium",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "eip-7702-phishing",
 "product": "An Ethereum wallet holding TAPEETH mining rewards",
 "tags": [
  "ethereum",
  "eip-7702-phishing",
  "eip-7702",
  "type-4-transaction",
  "sponsored-transaction",
  "exvul",
  "tapeeth"
 ],
 "amountUsd": 22770,
 "victims": 1,
 "startedAt": "2026-10-14",
 "closedAt": null,
 "updatedAt": "2026-10-14T12:00:00Z",
 "summary": "On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later.",
 "timeline": [
  {
   "date": "2026-10-14",
   "title": "Attacker submits a sponsored type-4 transaction using the victim's earlier EIP-7702 authorization and drains 9.1231 ETH plus TAPEETH.",
   "sourceUrl": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee"
  },
  {
   "date": "2026-10-14",
   "title": "ExVul flags the drain and says the malicious delegation is still active; crypto.news reports it.",
   "sourceUrl": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Ethereum user loses $22K in EIP-7702 wallet attack",
   "url": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/",
   "publisher": "crypto.news",
   "date": "2026-10-14"
  },
  {
   "kind": "onchain",
   "title": "Drain transaction",
   "url": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee",
   "publisher": "Etherscan",
   "date": "2026-10-14"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x9208097c007be15e28b20e94e66870a3f9f820bc",
   "0x0366b55f948a688888ca6e029ad0831f6ec260d1"
  ]
 },
 "brief": "## Am I affected?\nIf you ever signed an EIP-7702 authorization from a website, open your address on a block explorer and check whether it is delegated to a contract. A delegation stays in force until you change it, even if nothing happened for weeks.\n\n## What to do now\n- If the delegate contract is not one your wallet app set, move funds to a new wallet right away.\n- Revoke or reset the delegation from a trusted wallet if possible.\n\n## How to avoid this\n- Never sign 'upgrade account', 'enable batching' or similar authorization prompts that come from a site rather than your wallet.\n- Remember that one signature can be used later by anyone who pays the gas.\n- Use a wallet that shows and lets you clear active 7702 delegations.",
 "notes": null,
 "agentBrief": "# Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet\n\n- Severity: Medium · Status: Still active (live)\n- Chains: Ethereum · Method: EIP-7702 delegation phishing\n- Started: Oct 14, 2026 · Last update: Oct 14, 2026 · Reported stolen: $23K · Victims: 1\n- Who/what: An Ethereum wallet holding TAPEETH mining rewards\n\nOn 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later.\n\n## Am I affected?\nIf you ever signed an EIP-7702 authorization from a website, open your address on a block explorer and check whether it is delegated to a contract. A delegation stays in force until you change it, even if nothing happened for weeks.\n\n## What to do now\n- If the delegate contract is not one your wallet app set, move funds to a new wallet right away.\n- Revoke or reset the delegation from a trusted wallet if possible.\n\n## How to avoid this\n- Never sign 'upgrade account', 'enable batching' or similar authorization prompts that come from a site rather than your wallet.\n- Remember that one signature can be used later by anyone who pays the gas.\n- Use a wallet that shows and lets you clear active 7702 delegations.\n\n## Indicators (block these, never visit them)\n- Address: 0x9208097c007be15e28b20e94e66870a3f9f820bc\n- Address: 0x0366b55f948a688888ca6e029ad0831f6ec260d1\n\n## Sources\n- Ethereum user loses $22K in EIP-7702 wallet attack (crypto.news, 2026-10-14): https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/\n- Drain transaction (Etherscan, 2026-10-14): https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee\n\nFull record: https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026 · JSON: https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}