Ethereum Wallet Drained Using EIP-7702 Authorization
An attacker exploited an EIP-7702 delegation to gain account control and transfer assets without using flash loans.
Updated on Oct. 14, 2026 in Cybersecurity
Live Poll
Do you trust current digital wallet security features to keep your personal assets safe?
An Ethereum wallet was drained of 9.1231 ETH, worth roughly $22,770, and 1.69271471 TAPEETH tokens. Security firm ExVul identified that the attacker leveraged an EIP-7702 authorization to gain unauthorized control over the victim's account.
Why it matters
This incident highlights the security risks inherent in EIP-7702, an Ethereum upgrade intended to improve account abstraction that can be weaponized if malicious delegations are signed by users.
The attacker utilized address 0x9208097c007be15e28b20e94e66870a3f9f820bc to invoke the PodMining.claim() function. The malicious delegation remained active at Ethereum block 26,188,153.
The players
ExVul
A blockchain security firm that specializes in identifying and tracking malicious smart contract activity and exploitation patterns.
The details
The attack utilized EIP-7702, a protocol update that allows a regular Ethereum wallet to temporarily act as a smart contract. By signing a malicious delegation, the victim granted a controller address the ability to operate under the account context. This allowed the attacker to execute transactions, such as calling the PodMining.claim() function, while bypassing the need for flash loans or automated market maker manipulation.
Timeline
May 2025: Wintermute identified widespread use of EIP-7702 drainer contracts.
September 2025: World Liberty Financial token holders suffered delegation attacks.
July 2026: An Ethereum phishing incident involved nearly $1 million in assets.
October 14, 2026: ExVul reported the wallet attack.
The Tech Race
This incident follows the exploitation pattern established by the September 2025 World Liberty Financial delegation attacks. It underscores a growing trend where malicious actors weaponize account abstraction features to bypass standard wallet security controls.
Users should verify all authorization requests to ensure they are not signing malicious EIP-7702 delegations. If an account is compromised, the victim may need to clear or replace the authorization immediately to secure remaining assets.
The takeaway
The incident demonstrates that even advanced account abstraction protocols require rigorous user-side validation of signature requests. Users should remain vigilant against requests that grant control over their account context.
Further reading
For broader context on current threats, read more in Cybersecurity.
Live Poll
Do you trust current digital wallet security features to keep your personal assets safe?
