{
 "tag": "eip-7702-phishing",
 "name": "EIP-7702 delegation phishing",
 "group": "Drain methods",
 "incidents": [
  {
   "slug": "eip-7702-delegation-drain-22k-oct-2026",
   "title": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026",
   "json": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "eip-7702-phishing",
   "product": "An Ethereum wallet holding TAPEETH mining rewards",
   "tags": [
    "ethereum",
    "eip-7702-phishing",
    "eip-7702",
    "type-4-transaction",
    "sponsored-transaction",
    "exvul",
    "tapeeth"
   ],
   "amountUsd": 22770,
   "victims": 1,
   "startedAt": "2026-10-14",
   "closedAt": null,
   "updatedAt": "2026-10-14T12:00:00Z",
   "summary": "On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later."
  },
  {
   "slug": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "title": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026",
   "json": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json",
   "status": "live",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "eip-7702-phishing",
   "product": "Users of EIP-7702 smart accounts on Ethereum and other EVM chains",
   "tags": [
    "multi-evm",
    "eip-7702-phishing",
    "eip-7702",
    "research",
    "usenix",
    "sweeper",
    "smart-account",
    "advisory"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-01",
   "closedAt": null,
   "updatedAt": "2026-08-01T12:00:00Z",
   "summary": "A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector."
  },
  {
   "slug": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "title": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
   "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "json": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "bsc"
   ],
   "method": "eip-7702-phishing",
   "product": "A PancakeSwap liquidity provider (BNB Chain)",
   "tags": [
    "bsc",
    "eip-7702-phishing",
    "eip-7702",
    "pancakeswap",
    "liquidity-provider",
    "tornado-cash",
    "specter"
   ],
   "amountUsd": 2960000,
   "victims": 1,
   "startedAt": "2026-07-23",
   "closedAt": "2026-07-23",
   "updatedAt": "2026-07-23T12:00:00Z",
   "summary": "A long-inactive PancakeSwap liquidity provider lost about $2.96 million after signing a malicious EIP-7702 authorization, according to Specter monitoring reported by ChainCatcher on 23 July 2026. The attacker pulled about $1.48M of BSC-USD and $1.48M of BUSD liquidity, sent about $1.46M to Tornado Cash and still held about $1.48M in USDT at the time. An EIP-7702 authorization hands control of your whole account to a contract, so never sign one from a site you did not seek out."
  }
 ],
 "changes": [
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "Attacker submits a sponsored type-4 transaction using the victim's earlier EIP-7702 authorization and drains 9.1231 ETH plus TAPEETH.",
   "sourceUrl": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  },
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "ExVul flags the drain and says the malicious delegation is still active; crypto.news reports it.",
   "sourceUrl": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-01",
   "title": "USENIX Security '26 publishes the study reporting 924 malicious contract accounts and more than $2.3M in losses.",
   "sourceUrl": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "eip-7702-pancakeswap-lp-2-96m-jul-2026",
   "incidentTitle": "Dormant PancakeSwap LP loses $2.96M after signing a malicious EIP-7702 authorization",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-07-23",
   "title": "Specter reports a dormant PancakeSwap LP lost about $2.96M after signing a malicious EIP-7702 authorization; about $1.46M goes to Tornado Cash.",
   "sourceUrl": "https://www.chaincatcher.com/en/article/2277886",
   "url": "https://drains.watch/i/eip-7702-pancakeswap-lp-2-96m-jul-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-13",
   "title": "A separate arXiv paper on EIP-7702 phishing reports that authorizations are dominated by a few contract families linked to criminal activity.",
   "sourceUrl": "https://arxiv.org/abs/2512.12174v1",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  }
 ]
}