An Ethereum wallet tied to the handle sven.eth lost 9.1231 ETH, worth roughly $22,770, along with a stash of TAPEETH tokens on October 14, 2026. The victim did not click a fake link that day. Weeks earlier, they had signed something that looked routine: an authorization under Ethereum’s EIP-7702 standard. That single signature sat dormant until an attacker activated it, drained the account in one transaction, and moved on. Security firm ExVul flagged the incident within hours, and it became the latest entry in a growing ledger of EIP-7702 delegation attacks that has cost crypto users well over a million dollars in October alone.
The sven.eth loss is small by crypto-crime standards. What makes it notable is the mechanism. EIP-7702, the Ethereum upgrade that let ordinary wallets temporarily act like smart contracts, is now the preferred tool for a specific class of thief: one who doesn’t need your seed phrase, just your signature. crypto.news reported that the attacker used a sponsored transaction to activate a delegation the victim had unknowingly signed days before, chaining a reward claim, a token transfer, and an ETH withdrawal into a single atomic move.
What EIP-7702 Changed About Ethereum Wallets
EIP-7702 arrived with Ethereum’s Pectra upgrade in May 2025. Before Pectra, a standard Ethereum account, known as an externally owned account, could only send simple transactions. It had no code, no batch logic, and no way to sponsor someone else’s gas fees. EIP-7702 changed that by letting an externally owned account temporarily point to smart contract code and run as if it were a programmable wallet, just for the length of a single transaction.
The upgrade solved a real problem. Wallet teams at MetaMask, Rabby, Trust Wallet, and hardware makers like Ledger had spent years asking for account abstraction features: batch transactions, sponsored gas, session keys, and social recovery. Documentation on the rollout shows MetaMask, Rabby, Trust Wallet, and Ledger devices including the Flex, Stax, Nano X, and Nano S Plus all added EIP-7702 support through 2025, rolling programmable-wallet features out to millions of existing accounts without forcing anyone to migrate to a new address.
That convenience carries a cost most users never see. Signing an EIP-7702 authorization points your account at a piece of code chosen by whoever asked for the signature. If that code belongs to an app you trust, you get batch swaps and gasless transfers. If it belongs to an attacker, you get a wallet that drains itself the next time anything of value touches it. The account does not change address and does not look compromised at a glance. It just quietly stops being fully yours.
How the EIP-7702 Drainer Attack Actually Works
The attack chain is short and that is precisely the problem. A phishing site or a fake dApp presents a wallet signature request dressed up as something routine, a token approval, a staking claim, or a free airdrop. The victim reads a wall of hexadecimal data, sees a familiar wallet pop-up, and clicks confirm. That one click signs an EIP-7702 authorization naming the attacker’s contract as the account’s delegate.
SlowMist founder Yu Xiang described the experience from the victim’s side in blunt terms. “From the perspective of a phished user, it goes like this: the user opens a phishing website, a wallet signature prompt pops up, the user clicks confirm, and with just that one action, all valuable assets in the wallet address vanish in a snap,” Yu Xiang told CryptoSlate.
Here is the part that surprises most victims: the drain doesn’t have to happen immediately. Attackers can hold a signed authorization for days or weeks, waiting until the wallet holds enough value to make activation worthwhile. When they’re ready, they submit a sponsored transaction that pays the gas themselves, so the victim never sees a pending transaction or a wallet balance warning. The delegated code then runs a batch of operations, claiming staking rewards, transferring tokens, and withdrawing ETH, all inside one transaction the victim never approved in the moment it happened.
Rahul Rumalla, chief product officer at smart-wallet infrastructure firm Safe, put the underlying tradeoff plainly. “7702 was never meant to be a silver bullet and it does have great use cases,” Rumalla told BeInCrypto. The standard works as designed. The danger sits entirely in what a user agrees to sign, not in a bug in the Ethereum protocol itself.
$1.54 Million Gone in a Single Reported Loss
The sven.eth case grabbed headlines partly because of its size. Just four days earlier, on October 10, 2026, a far larger loss hit the same attack category. Scam Sniffer flagged a victim who signed an EIP-7702 phishing batch transaction covering multiple staked assets, including ETH and BTC-pegged tokens, for a reported loss of approximately $1.54 million. ChainCatcher’s coverage noted that SlowMist founder Yu Xian forwarded the Scam Sniffer warning directly, underscoring how quickly these losses move through the security community’s informal alert network.
Yu Xian described the mechanics of that specific campaign: “The phishing gang uses this mechanism to complete batch authorization operations on tokens related to the victim’s address.” The phrase batch authorization is doing a lot of work there. It means a single signed delegation can touch every asset class in a wallet in one pass, not just the one token a victim thought they were approving.
Separate research cited by EconoTimes put a wider lens on the problem, estimating that more than 63% of early EIP-7702 authorizations observed on-chain were tied to harmful contracts, with roughly $2.36 million in confirmed losses and another $10.14 million in continuing exposure sitting in wallets that had signed a risky delegation but hadn’t been drained yet. That figure deserves a caveat: it comes from a secondary research estimate rather than an audited industry total, and no single firm has published a complete 2026 ledger of every EIP-7702 drain. What the available incidents do show, consistently, is that losses cluster around a handful of techniques rather than one-off exploits.
CrimeEnjoyor: One Contract Behind Most of the Damage
If EIP-7702 drainers sound like a scattershot problem, the on-chain data says otherwise. Research from trading firm Wintermute, summarized by HOGE Wire, found that more than 97% of malicious EIP-7702 delegations observed on Ethereum pointed to copies of a single reusable piece of bytecode. Researchers nicknamed it CrimeEnjoyor. The contract sits dormant at a delegated address and automatically sweeps any ETH, NFTs, or ERC-20 tokens that land there, no manual intervention required once the delegation is live.
The same research traced one campaign where attackers spent around 2.88 ETH, worth a few thousand dollars at the time, to authorize roughly 79,000 addresses against sweeper contracts. One single contract handled delegations for more than 52,000 of those addresses on its own. The campaign’s economics turned out messier than the headline number suggests. Many of the 79,000 addresses were already compromised, empty wallets whose keys had leaked elsewhere, so the mass-authorization run produced far less profit than its scale implied. That distinction matters for anyone reading these numbers: 79,000 authorized addresses is not the same as 79,000 new victims.
Still, the concentration of malicious delegations into one reusable contract tells its own story. It means the drainer economy has industrialized. Instead of writing bespoke exploit code for each target, criminal groups deploy CrimeEnjoyor clones and distribute the phishing links, letting the same sweeper logic do the draining across thousands of wallets at once.
Tracking the 2026 EIP-7702 Incident Timeline
Putting the publicly reported incidents side by side shows a pattern that accelerated through the back half of 2026. Early activity was experimental and scattered. By October, losses were landing at six- and seven-figure scale within days of each other.
| Date (2026) | Incident | Reported Loss | Attack Method |
|---|---|---|---|
| May 2025 (baseline) | Pectra upgrade activates EIP-7702 | N/A (feature launch) | Account delegation introduced network-wide |
| Mid-2026 | Inferno Drainer-linked phishing wave | Up to $150,000 per case | Batch authorization via delegated MetaMask wallets |
| Sept-Oct 2026 | Wintermute-tracked sweeper campaign | 2.88 ETH spent to authorize ~79,000 addresses | CrimeEnjoyor reusable sweeper contract |
| Oct 10, 2026 | Scam Sniffer-flagged staking victim | ~$1.54 million | Batch authorization covering ETH and BTC-pegged staked assets |
| Oct 14, 2026 | sven.eth wallet drain | ~$22,770 (9.1231 ETH + TAPEETH) | Sponsored transaction activating a dormant signed delegation |
Reading the table left to right, the trend is less about any single catastrophic hack and more about frequency. EIP-7702 drains are now a recurring weekly event rather than a rare anomaly, and the dollar figures per incident are climbing even as the technique itself stays largely unchanged.
From Inferno Drainer to EIP-7702: How Phishing Tactics Evolved
None of this is entirely new. Drainer kits like Inferno Drainer and Pink Drainer built a criminal cottage industry around tricking victims into approving malicious token allowances, a technique that has drained wallets for years using the ERC-20 approve function. The old playbook had a limit built in: an approval only covers the specific token a victim signed off on. Drain one token, and the rest of the wallet stays safe unless the victim signs again.
EIP-7702 erased that limit. Yu Xian explained how the older drainer groups adapted once the new standard became available, noting that attackers shifted toward authorizing an entire account rather than one token at a time. “The new mechanism EIP-7702 is used most by coin stealing groups (not phishing groups) to automatically transfer funds from wallet addresses with leaked private keys/mnemonics,” he told BeInCrypto, pointing out that some of the activity targets wallets whose credentials were already compromised through older means, with EIP-7702 serving as the automated cleanup tool rather than the initial break-in.
Yu Xian had flagged the shift before it fully materialized. Discussing an earlier Inferno Drainer campaign that stole roughly $150,000 through delegated wallets, he warned: “As we predicted, the phishing gangs have caught up… Everyone should be vigilant, be careful that the assets in your wallet will be taken away.” The prediction held. What started as a niche technique used by a handful of coin-stealing crews became, within months, the dominant drainer method tracked across multiple security firms.
Comparing Wallet Drainer Techniques Side by Side
Not every wallet-draining technique carries the same risk profile. The table below lines up three generations of the attack to show why EIP-7702 delegation is drawing so much attention from security researchers right now.
| Technique | What the Victim Signs | Assets at Risk | Detection Difficulty |
|---|---|---|---|
| Seed phrase theft | Nothing on-chain, phrase typed into a fake site | Entire wallet, all chains | Low once used, no on-chain warning beforehand |
| ERC-20 approval phishing (Inferno Drainer, Pink Drainer) | Token allowance for one asset | Single token or NFT collection | Medium, allowance checkers can flag it |
| EIP-7702 delegation drainer (CrimeEnjoyor and copies) | Account-level code delegation | Entire account: ETH, tokens, NFTs, staking rewards in one sweep | High, delegation can sit dormant for weeks |
The key difference sits in the third row. An approval phishing attack is bad, but it’s bounded. An EIP-7702 delegation attack hands over a programmable copy of the account itself, and that copy can wait, watch, and strike whenever the wallet looks worth draining. Security researchers describe this as the shift from stealing a single key to leasing control of the whole house.
Why Firms Call This a Signature Problem, Not a Protocol Bug
Every security firm quoted in this reporting agrees on one point: EIP-7702 is not broken code. Ethereum’s core developers built the standard to spec, and it does exactly what it was designed to do, which is let an account temporarily run contract logic. The actual failure point sits earlier in the chain, at the moment a human reads a signature request and decides whether to trust it.
Most wallet interfaces still show EIP-7702 authorization requests as a block of unreadable hex data rather than plain language describing what the signature actually grants. Industry researchers refer to this gap as blind signing, where a user approves a request without any human-readable preview of its consequences. Efforts like the ERC-7730 clear-signing standard aim to translate these requests into readable summaries before a wallet lets someone confirm, but adoption across wallet providers remains uneven heading into the end of 2026.
That gap explains why identical advice keeps repeating across every firm tracking this trend: treat an EIP-7702 authorization prompt with the same suspicion as a request for your seed phrase, because functionally, in terms of what it can do to the account, it isn’t far off.
Wallet Providers Respond: What MetaMask, Rabby, and Ledger Offer
Wallet makers rolled out EIP-7702 support broadly during 2025 to unlock legitimate features: gas sponsorship, batch transactions, and session-based permissions that make everyday use smoother. MetaMask ships a Smart Accounts toggle in its advanced settings that governs whether an account can be delegated at all. Rabby, Trust Wallet, and Ledger’s hardware line, including the Flex, Stax, Nano X, and Nano S Plus, support the standard as well, giving users broad compatibility across the ecosystem.
What’s missing, based on the available public reporting, is a uniform, prominent warning layer specific to malicious delegation requests. Some wallets show a generic signature-request screen that looks identical whether the authorization is legitimate or hostile. Users who want to check an existing delegation can typically do so through a delegation checker tool that reads the account’s current authorization status directly from the chain, though this remains a manual step most wallet holders never think to take until after a loss is reported.
The practical advice from firms like Safe centers on treating smart-account features as opt-in power tools rather than defaults. Rumalla’s point about 7702 not being a silver bullet cuts both ways: the standard enables useful account abstraction, but wallets that enable it by default for every user, without clear signing support, are shipping convenience ahead of comprehension.
Market Impact: What This Means for Ethereum and DeFi Confidence
EIP-7702 drainer losses are a rounding error against Ethereum’s total value locked, but the reputational cost compounds differently than a raw dollar figure. Every incident that gets traced back to a signature a victim remembers clicking reinforces a narrative that self-custody is a trap for anyone who isn’t a full-time security researcher. That narrative matters for adoption, especially as more exchanges and custodians point retail users toward self-hosted wallets as a safer alternative to centralized exchange hacks.
There’s a second-order effect on the account abstraction roadmap itself. EIP-7702 was framed as a bridge toward native account abstraction standards like ERC-4337, which bundles smart contract wallet logic more tightly into the protocol. If delegation attacks keep climbing, wallet teams face pressure to slow default rollout of smart-account features or add friction back into flows that were designed to remove it, a tension between security and the smoother user experience account abstraction was supposed to deliver in the first place.
DeFi protocols that rely on gasless transactions and session keys, features that depend on EIP-7702-style delegation, also carry some exposure by association. A string of drainer headlines tied to the same underlying standard can slow institutional comfort with newer wallet infrastructure, even when the protocols themselves carry no direct fault.
Historical Context: From Seed Phrases to Signature Phishing
Crypto wallet theft has moved through distinct eras. Early Bitcoin and Ethereum losses mostly came from exchange hacks or outright seed phrase theft, where a victim typed their recovery phrase into a fake site or stored it somewhere an attacker could physically access. Hardware wallets pushed back against that era by keeping private keys offline entirely.
The ERC-20 approval phishing era that followed, driven by kits like Inferno Drainer and Pink Drainer, shifted the attack surface to smart contract permissions rather than raw keys. Wallet allowance checkers and revocation tools emerged as the community’s answer, and they worked reasonably well because approvals were asset-specific and visible on-chain.
EIP-7702 delegation attacks represent a third era: account-level control rather than asset-level permission. The defenses that worked against approval phishing don’t fully translate, because a delegation isn’t scoped to one token, and because the authorization can be signed long before it’s ever activated. Each era required new tooling to catch up with a new attack surface, and based on the pace of 2026 incidents, the delegation era’s tooling is still playing catch-up.
Five Predictions for How EIP-7702 Security Evolves
- Clear signing becomes a default, not an add-on. Expect major wallets to roll out human-readable previews of delegation requests, similar to ERC-7730 clear signing, as a baseline feature rather than an opt-in setting by mid-2027.
- Delegation checkers get built into wallet home screens. Instead of requiring users to seek out a separate tool, wallets will likely surface active delegations directly in the account view, flagging anything pointed at an unrecognized contract.
- CrimeEnjoyor-style sweeper contracts get added to blocklists faster. Given that 97% of malicious delegations traced back to one reusable contract family, expect wallet providers and security firms to blocklist known sweeper bytecode patterns proactively rather than reactively.
- Phishing kits will package EIP-7702 as a standard feature. Just as Inferno Drainer and Pink Drainer sold approval-phishing kits, expect drainer-as-a-service offerings to add one-click EIP-7702 delegation modules for less technical criminal buyers.
- Insurance and recovery products targeting delegation attacks will emerge. As losses climb into the millions, expect at least one wallet insurer or custody provider to market delegation-specific coverage or monitoring as a differentiator.
How to Check and Protect Your Wallet Right Now
Anyone holding funds in an Ethereum-based wallet that has interacted with newer dApps over the past year should treat a quick delegation check as routine maintenance, the same way people check token allowances after a phishing scare. A handful of practical habits cut the risk meaningfully.
- Read every signature prompt that mentions delegation, authorization, or batch execution before confirming, even if the surrounding site looks legitimate.
- Use a wallet’s delegation checker, where available, to confirm your account isn’t currently pointed at an unrecognized contract address.
- Treat gasless, sponsored, or free-claim offers with extra suspicion. Attackers favor sponsored transactions precisely because victims never see a pending gas fee that would otherwise raise a flag.
- Keep high-value holdings in a wallet that has never signed an EIP-7702 authorization, separate from a hot wallet used for everyday dApp interaction.
- If you suspect you’ve signed a malicious authorization, move remaining assets to a brand-new address rather than assuming revocation alone clears the risk.
None of these steps require giving up the convenience EIP-7702 enables. They just put a human check back into a process that attackers are counting on being skipped.
Frequently Asked Questions
What is EIP-7702 in simple terms?
It’s an Ethereum upgrade from the May 2025 Pectra release that lets a regular wallet address temporarily run smart contract code, enabling features like batch transactions and gas sponsorship without changing the account’s address.
Is EIP-7702 itself a security vulnerability?
No. Security researchers, including Safe’s Rahul Rumalla, describe the standard as working as intended. The risk comes from users signing authorization requests that delegate control to attacker-chosen code, not from a flaw in Ethereum’s protocol.
How much money has been lost to EIP-7702 drainers in 2026?
There’s no single audited total. Reported individual losses include approximately $1.54 million on October 10, 2026, and $22,770 on October 14, 2026, while a separate research estimate put confirmed losses from early malicious authorizations at around $2.36 million with another $10.14 million in continued exposure.
What is CrimeEnjoyor?
It’s the nickname researchers at Wintermute gave to a reusable sweeper contract that accounted for more than 97% of malicious EIP-7702 delegations they observed, automatically draining ETH, NFTs, and tokens sent to a compromised address.
Does a hardware wallet protect against EIP-7702 drainers?
Hardware wallets like Ledger’s Flex, Stax, Nano X, and Nano S Plus support EIP-7702, which protects your private key from exposure but does not stop you from signing a malicious authorization if you approve one. The device confirms what you sign, but it doesn’t evaluate whether the delegation itself is safe.
How is this different from the Inferno Drainer or Pink Drainer scams?
Inferno Drainer and Pink Drainer relied mainly on tricking victims into approving a malicious token allowance, which is limited to specific assets. EIP-7702 drainers delegate control of the entire account, letting an attacker batch multiple operations, tokens, NFTs, and ETH, into a single drain.
Can I check if my wallet already signed a malicious EIP-7702 delegation?
Yes. Several wallet tools and block explorers offer a delegation checker that reads your account’s current authorization status directly from the chain, letting you confirm whether it’s pointed at a known contract or something unrecognized.