{
 "tag": "exvul",
 "name": "Exvul",
 "group": "Other",
 "incidents": [
  {
   "slug": "eip-7702-delegation-drain-22k-oct-2026",
   "title": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026",
   "json": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026.json",
   "status": "live",
   "severity": "medium",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "eip-7702-phishing",
   "product": "An Ethereum wallet holding TAPEETH mining rewards",
   "tags": [
    "ethereum",
    "eip-7702-phishing",
    "eip-7702",
    "type-4-transaction",
    "sponsored-transaction",
    "exvul",
    "tapeeth"
   ],
   "amountUsd": 22770,
   "victims": 1,
   "startedAt": "2026-10-14",
   "closedAt": null,
   "updatedAt": "2026-10-14T12:00:00Z",
   "summary": "On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later."
  }
 ],
 "changes": [
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "Attacker submits a sponsored type-4 transaction using the victim's earlier EIP-7702 authorization and drains 9.1231 ETH plus TAPEETH.",
   "sourceUrl": "https://etherscan.io/tx/0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  },
  {
   "incident": "eip-7702-delegation-drain-22k-oct-2026",
   "incidentTitle": "Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet",
   "severity": "medium",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-14",
   "title": "ExVul flags the drain and says the malicious delegation is still active; crypto.news reports it.",
   "sourceUrl": "https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/",
   "url": "https://drains.watch/i/eip-7702-delegation-drain-22k-oct-2026"
  }
 ]
}