EIP-7702 delegation phishing
3 incidents, 2 live. 8 days since the last new one.
3 drains in the last 12 months
3 drains in the last 12 months
3 drains in 2026
Live
-
Medium✕Still active
Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet
On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later.
An Ethereum wallet holding TAPEETH mining rewards·Ethereum·$23K stolen·Since Oct 14, 2026·
-
Low✕Still active
USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts
A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector.
Users of EIP-7702 smart accounts on Ethereum and other EVM chains·Multiple EVM chains·Since Aug 1, 2026·
Past
July 2026 1
-
Critical✓Contained
Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization
A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out.
A PancakeSwap liquidity provider (BNB Chain)·BNB Chain·$3.0M stolen·Since Jul 23, 2026·
No drains match these filters.