Eighteen months after Ethereum's Pectra upgrade introduced EIP-7702 wallet delegation, academic research and on-chain data show the feature's earliest adoption was dominated by malicious actors. A USENIX Security 2026 study detected 924 malicious contract accounts across seven EIP-7702-enabled bl...
"Careful, there is some seriously dangerous code out there." — Charles Hoskinson, Founder of Cardano, October 30, 2026
Eighteen months after Ethereum's Pectra upgrade introduced EIP-7702 wallet delegation, academic research and on-chain data show the feature's earliest adoption was dominated by malicious actors. A USENIX Security 2026 study detected 924 malicious contract accounts across seven EIP-7702-enabled blockchains and found that 63% of authorization transactions were tied to attacker-controlled contracts. Confirmed losses from delegation-based phishing reached $2.36 million in retail wallets, with an additional $10.14 million identified as at-risk exposure.
Those retail figures are dwarfed by the October 29 Binance breach, where North Korean state-sponsored hackers used 50 pre-signed EIP-7702 authorizations to convert a Binance hot wallet into a sweeper contract, draining $2.53 billion in Ether, USDT, and other assets in a single transaction. The delegation remained live for three hours and 46 minutes, during which the attacker re-swept new deposits at least six more times. Combined with non-EIP-7702 thefts across nine other chains, total Binance losses reached $6.3 billion.
EIP-7702 is not broken. Security researchers confirm no protocol-level vulnerability. The standard functions as designed. The problem is structural: a single signed authorization grants persistent, unconditional execution control over a wallet. Attackers reached the signing infrastructure faster than the ecosystem built defenses around it.
EIP-7702, titled "Set Code for EOAs," was authored by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs, and lightclient in May 2024. It shipped with Ethereum's Pectra upgrade on May 7, 2025.
The standard introduces a new transaction type — the "set code transaction" — that carries an authorization list. Each authorization is signed with the private key of the account being upgraded and names the address of a smart contract whose code the account wants to execute. Once signed, the wallet's on-chain code pointer changes to 0xef0100 plus the delegate contract address. It stays there until the account signs a new authorization.
The practical result: an ordinary externally owned account (EOA) can batch transactions, sponsor gas for other users, implement custom validation logic, and perform other smart-account operations — without migrating funds to a new address. Coinbase Smart Wallet, MetaMask, Rabby, and Trust Wallet have all shipped EIP-7702 support.
The security tradeoff: a single signed authorization grants unconditional and persistent execution control. If a user signs a malicious authorization — through phishing, a compromised dApp, or a breached signing service — the attacker obtains full control of the wallet until the owner signs a replacement authorization.
EIP-7702 adoption has been rapid. According to on-chain data compiled by BundleBear and industry trackers:
Broader account abstraction adoption — combining ERC-4337 smart contract accounts with EIP-7702 delegated accounts — surpassed 200 million smart wallets in 2026, according to industry estimates from BlockEden and others.
The paper "Revealing the Dark Side of Smart Accounts: An Empirical Study of EIP-7702 Incurred Risks in Blockchain Ecosystem," authored by Mingyuan Huang, Han Liu, Shuo Yang, Daoyuan Wu, and Shuai Wang, was presented at USENIX Security 2026.
Key findings across seven EIP-7702-enabled blockchains:
| Metric | Value | |---|---| | EIP-7702 authorization transactions studied | 3.66 million | | Transactions linked to malicious contracts | ~2.3 million (63%) | | Malicious contract accounts detected | 924 | | Confirmed losses | $2.36 million | | Additional exposure from legacy contracts | $10.14 million | | Previously unreported zero-day cases | Multiple (count undisclosed) |
The researchers classified smart-account risks into three categories: EOA-targeted attacks (phishing users into signing authorizations), CA-targeted attacks (exploiting contract accounts that interact with delegated wallets), and composite attacks combining both vectors.
The finding that nearly half of the most frequently authorized contracts were controlled by attackers indicates that EIP-7702's earliest real-world adoption was shaped more by phishing infrastructure than by legitimate wallet upgrades.
A separate formal analysis, DelegProof, published via the IACR Cryptology ePrint Archive (2026/2060), provided the first symbolic verification of EIP-7702 authorization semantics composed with the ERC-4337 EntryPoint pipeline.
Using Tamarin proof models, the researchers identified ten machine-checked attack patterns:
These findings are distinct from the USENIX empirical work. DelegProof demonstrates that some risks are inherent to the EIP-7702 specification's interaction with existing Ethereum infrastructure, not merely implementation failures by wallet providers or user error.
On October 29, 2026, at approximately 20:20 UTC, an attacker submitted a single transaction containing 50 EIP-7702 authorizations targeting Binance 14, one of the exchange's primary Ethereum hot wallets. Each authorization was signed by the hot wallet's private key and pointed to an attacker-controlled sweeper contract that accepted instructions only from the operator.
Why 50 authorizations? A busy exchange hot wallet increments its nonce constantly as it processes withdrawals. A single pre-signed authorization would almost certainly be stale by execution time. The attacker prepared 50 authorizations covering consecutive nonces, guaranteeing that one would match the wallet's transaction count at the moment of submission.
The sweep: One authorization matched. The hot wallet's code pointer changed to the sweeper contract. A single transaction moved 167,464 ETH, 1.615 billion USDT, and other tokens — approximately $2.53 billion.
Persistence: The EIP-7702 delegation remained live. The attacker re-swept new deposits arriving at the hot wallet at least six additional times. At 00:10:35 UTC on October 30 — three hours and 46 minutes after the initial sweep — Binance signed a new authorization resetting the delegation.
Root cause: According to Binance, the attack began with a compromised DevOps engineer's laptop obtained through a fake job interview. The hackers used stolen credentials to access Binance's internal wallet-signing service, enabling them to generate the 50 signed authorizations. TRM Labs attributed the attack to TraderTraitor, North Korea's state-sponsored hacking unit.
The FBI flagged 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address tied to the stolen proceeds. Tether, Circle, and other partners froze approximately $3 billion within the first day. Total losses across 10 blockchains reached $6.3 billion, according to Binance's own estimate.
Security analysts at Fireblocks, Hacken, and CCN noted that the attacker could have drained wallets without EIP-7702 — the signing keys were already compromised. However, EIP-7702 allowed the sweep to execute in one transaction and may have bypassed certain withdrawal safeguards that would have flagged sequential individual transfers.
Below the headline Binance numbers, a pattern of retail EIP-7702 phishing attacks has been documented throughout 2026:
October 10, 2026: A victim signed a phishing batch transaction covering multiple staked assets, losing approximately $1.54 million. The funds moved through delegation chains. An entity tracked as "CrimeEnjoyor" operated a sweeper contract responsible for 97% of EIP-7702 drains prior to this incident, according to research by Shattered.io.
October 14, 2026: An Ethereum wallet lost $22,770 in a separate EIP-7702 delegation attack documented by CryptoTimes.
Mid-2026 phishing wave: Individual losses reached up to $150,000 per incident across multiple cases.
The attack vector is consistent: fake dApps prompt users to sign an EIP-7702 authorization disguised as a routine swap approval or staking operation. Once signed, the authorization hands account control to the attacker.
Major wallet providers have implemented defense layers, though coverage remains uneven:
MetaMask: Hard-codes the delegated contract address. The Smart EOA feature only allows delegation to MetaMask's own audited contract. The signEIP7702Authorization method is internal and not exposed to web interfaces via window.ethereum. This prevents malicious dApps from requesting arbitrary delegations through the MetaMask interface.
Rabby and Trust Wallet: Both added EIP-7702 support with varying levels of authorization filtering.
Hardware wallets: As of March 2026, some hardware wallets could not sign authorizationList entries. Gas sponsorship and smart account activation were unavailable for certain hardware wallet users, indicating cautious rollout by providers like Ledger.
Node operators: Zebra 7.0.0 and later versions of Ethereum clients include delegation verification checks, but enforcement depends on wallet-level implementation.
The gap is clear: MetaMask's approach — restricting delegation to pre-audited contracts — prevents the most common phishing vector. But wallets that permit delegation to arbitrary contracts, or users who interact with raw signing interfaces, remain exposed.
The EIP-7702 security landscape reveals a value distribution pattern consistent with broader blockchain ecosystem dynamics. Security infrastructure — audits, formal verification, wallet hardening — absorbs economic resources that must be funded from somewhere in the value chain.
The $2.36 million in confirmed retail losses and the $6.3 billion Binance breach represent direct value extraction from the ecosystem. The $10.14 million in identified exposure from legacy contracts represents potential future extraction. Each loss transfers value from legitimate participants to attackers, reducing net economic returns for honest actors.
The countermeasure burden falls unevenly. Large wallet providers like MetaMask and Coinbase can afford dedicated security teams. Smaller wallets and dApps may lack the resources to implement comparable protections. This creates a two-tier security landscape where the vulnerability surface concentrates among less-resourced participants.
EIP-7702 delivered on its core promise: programmable wallets without address migration. Over 200 million smart wallets now use account abstraction features enabled or enhanced by the standard. The UX improvement is real.
The security cost is also real. Formal analysis identified specification-level risks. Empirical research found that attackers built delegation infrastructure faster than defenders. The Binance breach demonstrated what happens when a compromised signing service meets a protocol feature designed for maximum flexibility.
The next phase of the EIP-7702 lifecycle will be defined by whether the ecosystem converges on restrictive wallet implementations — MetaMask's hard-coded delegation model — or whether the permissionless, delegate-to-anything design persists in enough wallets to sustain the current attack surface. The data suggests the former is economically necessary. Whether it arrives before the next major exploit is an open question.