{
 "slug": "eip-7702-usenix-study-malicious-delegations-aug-2026",
 "title": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
 "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026",
 "json": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json",
 "status": "live",
 "severity": "low",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "eip-7702-phishing",
 "product": "Users of EIP-7702 smart accounts on Ethereum and other EVM chains",
 "tags": [
  "multi-evm",
  "eip-7702-phishing",
  "eip-7702",
  "research",
  "usenix",
  "sweeper",
  "smart-account",
  "advisory"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-08-01",
 "closedAt": null,
 "updatedAt": "2026-08-01T12:00:00Z",
 "summary": "A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.",
 "timeline": [
  {
   "date": "2025-12-13",
   "title": "A separate arXiv paper on EIP-7702 phishing reports that authorizations are dominated by a few contract families linked to criminal activity.",
   "sourceUrl": "https://arxiv.org/abs/2512.12174v1"
  },
  {
   "date": "2026-08-01",
   "title": "USENIX Security '26 publishes the study reporting 924 malicious contract accounts and more than $2.3M in losses.",
   "sourceUrl": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Revealing the Dark Side of Smart Accounts: An Empirical Study of EIP-7702 Incurred Risks in Blockchain Ecosystem",
   "url": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan",
   "publisher": "USENIX Security '26",
   "date": "2026-08-01"
  },
  {
   "kind": "writeup",
   "title": "EIP-7702 Phishing Attack (arXiv:2512.12174)",
   "url": "https://arxiv.org/abs/2512.12174v1",
   "publisher": "arXiv",
   "date": "2025-12-13"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nIf your address has an EIP-7702 delegation you did not set up through your own wallet app, you may be exposed. Check the address page on a block explorer.\n\n## What to do now\n- Clear unknown delegations or move funds to a fresh wallet.\n- If your private key ever leaked, assume sweeper contracts are watching the address and do not send funds back to it.\n\n## How to avoid this\n- Only enable smart-account features from inside your wallet, never from a dApp prompt.\n- Never sign authorizations with chain ID 0, which can be replayed on every chain.\n- Prefer wallets that warn on or block third-party 7702 requests.",
 "notes": null,
 "agentBrief": "# USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts\n\n- Severity: Low · Status: Still active (live)\n- Chains: Multiple EVM chains · Method: EIP-7702 delegation phishing\n- Started: Aug 1, 2026 · Last update: Aug 1, 2026\n- Who/what: Users of EIP-7702 smart accounts on Ethereum and other EVM chains\n\nA peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.\n\n## Am I affected?\nIf your address has an EIP-7702 delegation you did not set up through your own wallet app, you may be exposed. Check the address page on a block explorer.\n\n## What to do now\n- Clear unknown delegations or move funds to a fresh wallet.\n- If your private key ever leaked, assume sweeper contracts are watching the address and do not send funds back to it.\n\n## How to avoid this\n- Only enable smart-account features from inside your wallet, never from a dApp prompt.\n- Never sign authorizations with chain ID 0, which can be replayed on every chain.\n- Prefer wallets that warn on or block third-party 7702 requests.\n\n## Sources\n- Revealing the Dark Side of Smart Accounts: An Empirical Study of EIP-7702 Incurred Risks in Blockchain Ecosystem (USENIX Security '26, 2026-08-01): https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan\n- EIP-7702 Phishing Attack (arXiv:2512.12174) (arXiv, 2025-12-13): https://arxiv.org/abs/2512.12174v1\n\nFull record: https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026 · JSON: https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}