Overview
- EIP-7702, which went live in May 2025, lets a normal externally owned wallet address point to and execute external contract code and the study found attacker-linked contracts were involved in 2,322,548 of 3,664,166 observed authorizations.
- Researchers analyzed more than 22.8 billion transactions across seven chains and used filters, bytecode checks and manual review to verify 924 malicious contracts tied to those authorization transactions.
- The team measured about $2.36 million in confirmed thefts and a separate estimate found roughly $10.14 million in assets exposed when legacy contracts relied on sender-origin checks that no longer distinguish delegated behavior.
- Attackers reused malicious contracts, rebounded accounts to benign-looking code after thefts, and created 500 delegation targets with no deployed code so monitoring current state alone can miss past or future risk.
- In response ethereum.org and the researchers recommend wallets whitelist audited account implementations, clearly show delegation targets and initialization parameters, keep durable authorization histories, and restrict arbitrary delegation on hardware wallets to make delegation safer by default.