USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts
Users of EIP-7702 smart accounts on Ethereum and other EVM chains
A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.
Why this severity: Still active, a warning with little reported loss.
- Started
- Aug 1, 2026
- Chains
- Multiple EVM chains
At risk
- Users of EIP-7702 smart accounts on Ethereum and other EVM chains
- Multiple EVM chains wallets
What to do now
- Clear unknown delegations or move funds to a fresh wallet.
- If your private key ever leaked, assume sweeper contracts are watching the address and do not send funds back to it.
Stay safe
Am I affected?
If your address has an EIP-7702 delegation you did not set up through your own wallet app, you may be exposed. Check the address page on a block explorer.
What to do now
- Clear unknown delegations or move funds to a fresh wallet.
- If your private key ever leaked, assume sweeper contracts are watching the address and do not send funds back to it.
How to avoid this
- Only enable smart-account features from inside your wallet, never from a dApp prompt.
- Never sign authorizations with chain ID 0, which can be replayed on every chain.
- Prefer wallets that warn on or block third-party 7702 requests.
Timeline 2
News & write-ups ›2
How this method works
Since Ethereum's Pectra upgrade, a normal wallet can delegate itself to smart-contract code. Sign a malicious delegation and that code can do anything with your wallet. Read about eip-7702 delegation phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.