# USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts

- Severity: Low · Status: Still active (live)
- Chains: Multiple EVM chains · Method: EIP-7702 delegation phishing
- Started: Aug 1, 2026 · Last update: Aug 1, 2026
- Who/what: Users of EIP-7702 smart accounts on Ethereum and other EVM chains

A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.

## Am I affected?
If your address has an EIP-7702 delegation you did not set up through your own wallet app, you may be exposed. Check the address page on a block explorer.

## What to do now
- Clear unknown delegations or move funds to a fresh wallet.
- If your private key ever leaked, assume sweeper contracts are watching the address and do not send funds back to it.

## How to avoid this
- Only enable smart-account features from inside your wallet, never from a dApp prompt.
- Never sign authorizations with chain ID 0, which can be replayed on every chain.
- Prefer wallets that warn on or block third-party 7702 requests.

## Sources
- Revealing the Dark Side of Smart Accounts: An Empirical Study of EIP-7702 Incurred Risks in Blockchain Ecosystem (USENIX Security '26, 2026-08-01): https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan
- EIP-7702 Phishing Attack (arXiv:2512.12174) (arXiv, 2025-12-13): https://arxiv.org/abs/2512.12174v1

Full record: https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026 · JSON: https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.