EIP-7702 delegation phishing
Since Ethereum's Pectra upgrade, a normal wallet can delegate itself to smart-contract code. Sign a malicious delegation and that code can do anything with your wallet.
How it works
EIP-7702 lets an ordinary account (EOA) point to a contract and run its code, which enables batching and sponsored gas. The permission is granted by signing an authorization.
Drainers ask users to sign an authorization to their own contract, often disguised as a wallet upgrade or a gas-free claim. Once delegated, the contract can sweep tokens and ETH, and it keeps working until the delegation is replaced.
Some campaigns also abuse wallets that were delegated to sloppy contracts, sweeping anything sent to them automatically.
Red flags
- A prompt to 'upgrade your wallet to a smart account' from a site that isn't your wallet
- An authorization or delegation request with a contract you don't recognise
- Gas-free claims that need a delegation first
Protect yourself
- Only delegate through your wallet's own built-in smart-account feature
- Treat any delegation request from a website as a red flag
- Use a wallet that shows the delegate contract and warns on unknown ones
If you already signed
- Move funds out to a fresh wallet that never signed a delegation
- Clear or replace the delegation from your wallet if it supports it
- Don't send new funds to the affected address
Incidents using it 3
-
Medium✕Still active
Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet
On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later.
An Ethereum wallet holding TAPEETH mining rewards·Ethereum·$23K stolen·Since Oct 14, 2026·
-
Low✕Still active
USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts
A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.
Users of EIP-7702 smart accounts on Ethereum and other EVM chains·Multiple EVM chains·Since Aug 1, 2026·
-
Critical✓Contained
Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization
A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.
A PancakeSwap liquidity provider (BNB Chain)·BNB Chain·$3.0M stolen·Since Jul 23, 2026·