You open Etherscan to check your wallet address and notice that the "Code" field is no longer empty. Instead, it shows a string of contract code. Your heart sinks and you think your account has been stolen.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Do not panic yet. Having contract code does not always mean your wallet was hacked. It may mean that you actively enabled the delegation feature of EIP-7702. But if you do not remember authorizing anything at all, it is worth being careful.
Three possible reasons your address has contract code
If your address shows contract code, it usually matches one of the three situations below. First, check which one applies to you:
Case A: You actively enabled a smart wallet feature yourself (safe) You previously used a wallet feature such as "upgrade to smart account," or you took part in an EIP-7702 authorization operation, which temporarily gave your EOA address smart contract capabilities. Your private key still controls the address. You simply pointed the account's code field to a delegation contract through a type 0x04 transaction.
Case B: Someone used your private key to sign a delegation (needs immediate action) You did not do anything yourself, but your private key may already have been leaked. An attacker used your private key to sign an EIP-7702 authorization and installed a malicious contract on your address. Once this happens, your assets are exposed to risk.
Case C: You initiated a SET_CODE transaction through another wallet (judge based on your actions) EIP-7702 introduced a new transaction type called SET_CODE_TX_TYPE = 0x04. It allows an EOA to set a delegation contract with a single signature. If you clicked something like "batch transactions" or "account upgrade" in a wallet, this may be a normal feature.
How to tell whether your address has been hacked
[What to do]: Confirm whether the delegation contract address is trustworthy.
[How to do it]:
- Open Etherscan and enter your wallet address.
- Find the "Code" or "More Info" area on the page and check whether a delegation address is shown.
- If the delegation address is the official contract address of your wallet, for example if you used TokenPocket's one-click upgrade and the delegation address matches the official documentation, then you are safe.
- If the delegation address is completely unknown to you, or you never clicked any "upgrade" operation, that is a risk signal. According to Dune data, as of June 2025, among about 79,000 EIP-7702 authorization transactions, more than 97% of authorizations pointed to a single malicious contract.
Completion standard: You can determine whether the contract address shown on Etherscan is an official address you actively authorized, or an address you do not recognize at all.
What happens if you delegated to a malicious contract?
Risk warning: Once an EIP-7702 authorization is signed, it does not expire. One wrong signature may be enough to wipe out your assets instantly. After authorizing a malicious contract, an attacker can transfer all assets from your wallet at once without you noticing.
How the attack works:
- Bait: Scammers post links on social media, Telegram groups, or phishing websites promising "free airdrops" or "wallet upgrade rewards."
- Fake signature: After you click the link, the wallet shows a signature request. The interface may only display an unreadable hash value, making you think it is just a normal login verification.
- Persistent control: Once you confirm the signature, the malicious contract is "installed" on your address. After the authorization takes effect, the scammer gains persistent execution permission. They can then call your account and perform any operation without needing your signature again.
A peer-reviewed study published at USENIX Security '26 analyzed 3,664,166 EIP-7702 authorization transactions, identified 924 malicious contracts, and found that 63% of authorizations were related to attacker-associated contracts, with confirmed losses of about 2.36 million USD.
Right and wrong responses compared
| Action | Explanation |
|---|---|
| Wrong response | Seeing an "upgrade wallet" or "claim airdrop" popup on an unfamiliar website and clicking "confirm" to sign directly. |
| Correct response | 1. Directly reject any unknown message asking you to sign an EIP-7702 authorization. 2. Check the Code area on Etherscan and confirm that the delegation address is your wallet's official contract address. 3. If unsure, use eip7702.app (note: only enter the address to check, do not connect your wallet) or Revoke.cash to check authorization status. 4. If you find an abnormal delegation, revoke it immediately: send a new 0x04 transaction pointing the delegation address to 0x000...000, the zero address, to clear the delegation. |
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
A checklist for similar situations
Next time your wallet address shows contract code, go through this checklist:
| Check item | Safe status | Danger signal |
|---|---|---|
| Delegation contract address | Official contract address published by your wallet | An address you do not recognize at all |
| Did you act on it yourself | You remember clicking "upgrade to smart account" or something similar | You do not remember doing anything related |
| Wallet prompt | Before signing, the wallet showed a clear explanation of the 7702 authorization | The signature request only showed a hash value |
| Authorization history | You regularly check with Revoke.cash or Etherscan | You have never checked authorization records |
How to verify after taking action: Enter your wallet address on Etherscan and check the Code area. If it is empty or the delegation address is an official whitelist contract from your wallet, your account is safe. If the delegation address looks abnormal, immediately revoke the delegation using the steps above.
