{
 "tag": "smart-account",
 "name": "Smart Account",
 "group": "Other",
 "incidents": [
  {
   "slug": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "title": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026",
   "json": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026.json",
   "status": "live",
   "severity": "low",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "eip-7702-phishing",
   "product": "Users of EIP-7702 smart accounts on Ethereum and other EVM chains",
   "tags": [
    "multi-evm",
    "eip-7702-phishing",
    "eip-7702",
    "research",
    "usenix",
    "sweeper",
    "smart-account",
    "advisory"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-08-01",
   "closedAt": null,
   "updatedAt": "2026-08-01T12:00:00Z",
   "summary": "A peer-reviewed study presented at USENIX Security '26 (August 2026) found 924 malicious contract accounts across seven chains that support EIP-7702, with more than $2.3 million in losses and over 10 million users exposed. The authors say over 63% of authorization transactions in their data were linked to attacks on regular wallets, and nearly half of the most-authorized contracts were attacker-controlled. The study window ends in mid-2025, so it measures early abuse, not today's rate. It confirms that 7702 delegation is a major phishing and key-theft sweep vector."
  }
 ],
 "changes": [
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-08-01",
   "title": "USENIX Security '26 publishes the study reporting 924 malicious contract accounts and more than $2.3M in losses.",
   "sourceUrl": "https://www.usenix.org/conference/usenixsecurity26/presentation/huang-mingyuan",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  },
  {
   "incident": "eip-7702-usenix-study-malicious-delegations-aug-2026",
   "incidentTitle": "USENIX study: over 63% of EIP-7702 authorization transactions tied to malicious contracts",
   "severity": "low",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-12-13",
   "title": "A separate arXiv paper on EIP-7702 phishing reports that authorizations are dominated by a few contract families linked to criminal activity.",
   "sourceUrl": "https://arxiv.org/abs/2512.12174v1",
   "url": "https://drains.watch/i/eip-7702-usenix-study-malicious-delegations-aug-2026"
  }
 ]
}