Ethereum user loses $22K in EIP-7702 wallet attack

An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to gain control of the account.

• Security firm ExVul reported that an Ethereum wallet lost 9.1231 ETH through malicious account delegation.
• The reported attack involved 1.69271471 TAPEETH tokens alongside Ethereum valued at approximately $22,770 at detection.
• A sponsored EIP-7702 transaction reportedly enabled attacker controlled code to execute through the victim's wallet.
• ExVul attributed the theft to malicious wallet authorization, not a vulnerability in PodMining or TAPEETH.
• The security firm warned that the malicious delegation remained active at Ethereum block 26,188,153 afterward.

Blockchain security firm ExVul reported the incident on October 14, identifying an attacker-sponsored transaction that activated malicious code previously authorized by the wallet owner. The firm attributed the theft to an unsafe delegation, explaining that the attacker drained the wallet without exploiting the underlying DeFi protocol.

The reported incident involved the wallet linked to sven.eth and an attacker-controlled address beginning with 0x9208. According to ExVul's investigation, the authorization allowed code installed through Ethereum's EIP-7702 mechanism to operate with the wallet's permissions.

Ethereum EIP-7702 attack drains ETH and TAPEETH

The reported theft involved 9.1231 ETH and 1.69271471 TAPEETH, with the ETH portion valued at approximately $22,770 when ExVul published its findings. The security firm did not provide a separate dollar valuation for the TAPEETH tokens.

ExVul identified the transaction hash as 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee, linking the activity to a sponsored type-4 Ethereum transaction. Such transactions support EIP-7702 authorizations, which allow ordinary wallet addresses to execute smart contract code.

The investigation attributed the attack to 0x9208097c007be15e28b20e94e66870a3f9f820bc. The victim's wallet was identified as 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28, while the malicious delegation pointed to 0x0366b55f948a688888ca6e029ad0831f6ec260d1.

🚨 ALERT --- EIP-7702 Wallet Drain on Ethereum

sven.eth was drained for 9.1231 ETH net (~$22.77K) plus 1.69271471 TAPEETH.

No flash loan or AMM manipulation was involved: the attacker sponsored a type-4 transaction carrying the victim's valid EIP-7702 authorization, then swept... --- ExVul (@exvulsec) October 14, 2026

According to the security alert, the attacker submitted a transaction containing an EIP-7702 authorization signed by the victim. Once Ethereum processed that authorization, subsequent calls to the affected wallet executed the delegated contract's instructions within the victim account.

The attacker-controlled code reportedly contained a fixed address authorized to operate the wallet. The controller then invoked the PodMining.claim() function, transferred the resulting TAPEETH rewards and withdrew the wallet's ETH balance.

ExVul emphasized that "No flash loan or AMM manipulation was involved." Its findings identified the account authorization as the entry point, with no evidence in the supplied analysis of an exploit involving liquidity pools or price manipulation.

How malicious wallet delegation enabled the theft

EIP-7702 is part of Ethereum's account abstraction development, allowing externally owned accounts to temporarily gain smart contract functionality through delegated code.

Under the official Ethereum specification, a user signs an authorization identifying the smart contract that will control the account's execution behavior. Once submitted through a compatible transaction, Ethereum records the delegation and runs the designated code when the wallet receives relevant calls.

The feature supports legitimate applications, including sponsored transactions, transaction batching and more flexible wallet permissions. A user can authorize multiple actions through a single transaction or allow a third party to cover the network fee.

However, the same mechanism carries security risks when an account delegates execution to malicious code. Ethereum's EIP-7702 specification explains that poorly designed or malicious delegation contracts can grant an outside party extensive control over the account.

In this incident, the attacker reportedly paid the transaction fee and submitted the signed authorization. The wallet owner did not need to fund or broadcast the transaction that activated the malicious delegation.

The signature supplied authority for the wallet to execute the attacker's code. Once activated, the code operated under the victim's account context, allowing the controller address to initiate the reported asset transfers.

ExVul stated that the exploit "is not a TAPEETH / PodMining bug." The conclusion distinguishes the authorization mechanism from a vulnerability in the token or the reward contract.

The firm did not establish how the attacker obtained the victim's authorization. Its public findings do not identify a specific phishing website, malicious application or compromised signing interface.

Malicious authorization could threaten future deposits

After the reported theft, ExVul warned that the wallet's malicious delegation remained active at Ethereum block 26,188,153.

The warning concerns a feature of EIP-7702: setting a delegation does not automatically remove it when the transaction finishes. The authorized contract can remain associated with the wallet until the account owner replaces or clears the delegation.

Ethereum's official security guidance explains that a wallet owner retains control through the original private key, including the ability to reset delegation by authorizing the zero address. However, malicious delegated code may remain dangerous until the change is successfully processed.

ExVul warned users against transferring new assets into the affected address while the suspicious delegation remained active. Newly deposited funds could face the same exposure if the attacker's code continued to control spending permissions.

The firm recommended clearing or replacing the authorization and moving remaining assets to a secure wallet. Such recovery actions require care because the affected address may execute malicious instructions while the delegation persists.

The warning was based on the delegation status observed at block 26,188,153. ExVul's original alert did not establish whether the victim had subsequently removed the malicious code or recovered any assets.

No reimbursement arrangement, recovery transaction or law enforcement action was identified in the supplied investigation.

EIP-7702 has faced earlier wallet security concerns

The latest reported attack follows previous warnings from blockchain security researchers about malicious account delegations.

In May 2025, crypto market maker Wintermute identified widespread use of EIP-7702 contracts designed to automatically drain funds from compromised Ethereum wallets.

Wintermute's research found that more than 97% of observed EIP-7702 delegations at that stage pointed to contracts using identical code. Its analysis associated many of those delegations with automated sweepers that could transfer incoming ETH to attacker-controlled addresses.

The earlier security concerns surrounding Ethereum's Pectra upgrade centered on attackers abusing wallet delegation features introduced through EIP-7702. Security researchers warned that malicious code could remain connected to accounts after victims completed the initial authorization.

A separate incident involving World Liberty Financial tokens in September 2025 raised similar concerns. Blockchain investigator Yu Xian reported that attackers were using compromised wallet permissions and EIP-7702 delegation to target holders after token transfers became available.

The phishing attacks against WLFI token holders involved malicious delegation contracts that allowed attackers to execute unauthorized transactions. Investigators linked the activity to compromised wallet credentials and fraudulent authorizations.

In July 2026, another Ethereum phishing incident involving nearly $1 million demonstrated how dangerous wallet approvals can expose cryptocurrency holdings. That case involved malicious transaction permissions and was not established as the same exploit method reported against sven.eth.

Ethereum's EIP-7702 specification identifies several safeguards for developers building delegation contracts, including replay protection, authenticated transaction parameters and secure initialization procedures.

The specification warns that poorly implemented delegation contracts may give malicious actors nearly complete control over the affected account. It recommends carefully verifying the permissions granted to delegated code, particularly when external parties can submit transactions on behalf of wallet owners.

ExVul's October 14 alert identified the malicious contract, controller address and affected account, but did not disclose whether the victim had since replaced the authorization. The investigation recorded the suspicious delegation as active at block 26,188,153.