You see a wallet authorization popup and click confirm, thinking it is just an "account upgrade" or "batch transaction." But you may not know that a malicious EIP-7702 authorization can drain all the ETH, all ERC-20 tokens, and NFTs in your wallet in one go.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
This is not fearmongering. According to peer-reviewed research published at USENIX Security '26, 63% of EIP-7702 authorization transactions are linked to attacker-controlled contracts, with confirmed losses of about 2.36 million US dollars.
First, understand what a malicious contract can do after EIP-7702 authorization
EIP-7702 is a new transaction type (0x04) introduced by the Ethereum Pectra upgrade. It allows an ordinary EOA wallet to permanently delegate code execution rights to a smart contract with a single signature. Once set, the delegation remains active until you actively revoke it.
Once you delegate your wallet to a malicious contract, the following assets can all be drained at once:
ETH (Ethereum native coin): The malicious contract can execute transfers in the context of your wallet and directly move out all ETH.
All ERC-20 tokens: Including USDT, USDC, DAI, LINK, UNI, and others. The malicious contract can execute transfer or transferFrom operations through your wallet to move out these tokens.
NFTs: The malicious contract can transfer all NFTs in your wallet.
On-chain asset portfolio: In August 2025, a user lost about 1.54 million US dollars in such an attack, involving ETH, BTC, and other multi-chain assets.
Attack path reconstruction: How scammers do it
I broke down a typical EIP-7702 attack flow. Check whether you have encountered a similar pattern.
Step 1: Lay the bait Scammers post links on X, Telegram, or Discord for "free airdrops," "wallet upgrades," or "claim rewards," pointing to phishing websites.
Step 2: Fake a signature request After you click the link, your wallet pops up a signature request. The UI may look like a normal login verification or Swap confirmation, but it is actually an EIP-7702 authorization signature. After signing, your account code is set to the malicious contract address. The key to the phishing attack is that users see a string of seemingly harmless numeric fields, while the protocol interprets them as an account-level behavior change.
Step 3: Persistent control and asset draining After the authorization takes effect, your EOA becomes a "persistent proxy." Any subsequent call, whether from a user transaction, an external contract call, or a protocol callback, will unconditionally execute attacker-controlled logic. In August 2025, SlowMist founder Cosmos forwarded a Scam Sniffer security warning, pointing out that this phishing method had been "engineered into practice" by major phishing groups. If users are tricked into signing, they will lose the entire account's assets.
Comparison of correct and incorrect actions
| Action | Explanation |
|---|---|
| Wrong action | Seeing an "upgrade wallet" or "batch authorization" popup on an unfamiliar website and directly clicking "Confirm." |
| Correct action | For any unfamiliar website asking you to sign a 7702 authorization, close it immediately. If you must proceed, first verify the website's authenticity and confirm that the delegated contract address is an official whitelisted address. |
Risk reminder: EIP-7702 delegation is persistent and will not expire after a single transaction, until you explicitly clear or replace it. In addition, because the EOA is treated as "having code" after authorization, if the delegated contract does not implement the receive() or fallback() function, your incoming ETH transfers may fail.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
A checklist to apply the same idea elsewhere
If you suspect you may have fallen for an EIP-7702 phishing attack, follow these steps to check:
[What to do]: Confirm whether your wallet address has been delegated to a malicious contract, and revoke it.
[How to do it]:
Check delegation status: Enter your wallet address on Etherscan, look in the "More Info" or other information area, and find the "Delegate Information" or "Authorizations (EIP-7702)" field. If there is a non-zero address there, your wallet has been delegated.
Compare with the official delegation address: If the delegated address is not the contract address officially published by your wallet, revoke it immediately.
Revoke the delegation: Send a new EIP-7702 type transaction (0x04) and point the delegation address to 0x0000000000000000000000000000000000000000 (the zero address) to clear the delegation state and restore a normal EOA.
[Completion standard]: On Etherscan, confirm in the "Delegate Information" field that the delegated address has become the zero address or that the field has disappeared, and that the account has returned to normal EOA state.
How to verify completion: Enter your wallet address on Etherscan and confirm that there is no abnormal delegated address in the "Authorizations (EIP-7702)" section. If the displayed address is not an official delegation contract you trust, immediately revoke it using the steps above.
Next action: If you have ever clicked any "upgrade wallet" or "claim airdrop" button on an unfamiliar website, go to Etherscan now and check your delegation address. If it shows an address that is not your wallet's official address, do not wait. Clear it immediately. This habit is far more useful than asking others after something goes wrong.
