The Ethereum improvement proposal promised to turn every wallet into a smart contract. It succeeded. The code executed. But the metadata — the transaction logs, the delegate traces — told a different story. 63% of the 3.66 million EIP-7702 transactions were malicious. The upgrade didn't just enable flexibility; it enabled fraud at scale.
This is not a bug report. It's a systemic failure of trust assumptions. The code spoke, but the metadata lied.
Context: The Account Abstraction Mirage
EIP-7702, activated in the May 2025 Pectra upgrade, was sold as the next evolution of Ethereum accounts. It allowed Externally Owned Accounts (EOAs) to temporarily delegate their code to a smart contract — without changing the address. No migration. No new wallet. Just a cryptographic handshake that turned a static key pair into a programmable entity.
The promise was clear: account abstraction without the friction of ERC-4337's user operations. The reality: a three-month window where attackers exploited the delegation mechanism faster than the ecosystem could defend against it.
Based on the USENIX 2026 study — a forensic analysis of 228 billion historical transactions — the numbers are damning. 3.66 million EIP-7702 transactions. 2.3 million of them flagged as malicious. Over 242 distinct malicious contracts identified. 500 pre-deployed CREATE2 contracts waiting to be triggered. $2.36 million stolen directly. $10.14 million exposed through a single vulnerability in a popular wallet.
This isn't edge-case hacking. It's a structural vulnerability baked into the upgrade's design.
Core: The Forensic Dissection
Let me walk through the mechanics. I've spent the last week tracing these wallet clusters, mapping the attack flows. The pattern is repetitive.
Attack Vector 1: The Delegation Trap
EIP-7702 allows an EOA to sign a "delegation" — a message that points to a smart contract. Once signed, the EOA behaves like that contract. The problem: the delegation is not locked to a specific contract. It can be rebound. The attacker signs a benign delegation first, gains the user's trust, then swaps the target contract to a malicious one via a second signature.
The study found that 63% of all delegation transactions were part of this rebinding attack. The user thinks they're interacting with a legitimate DeFi aggregator. They're actually signing over control of their entire account.
Attack Vector 2: The tx.origin Blind Spot
Old DeFi contracts relied on msg.sender == tx.origin to prevent phishing. That check assumed the caller was an EOA. With EIP-7702, an EOA can be a contract. The check collapses. The study showed that 12% of the top 100 DeFi protocols by TVL still use this pattern. They are now vulnerable to delegation-based reentrancy.
Attack Vector 3: The 500 Sleeping Dragons
Attackers pre-deployed 500 CREATE2 contracts before the upgrade. These contracts are dormant — but the moment a user delegates to a benign address that the attacker controls, the pre-deployed contract activates. The study found that 27% of the malicious transactions involved these pre-deployed contracts. The attacker never needs to deploy on-chain during the attack. They set the trap months in advance.
Based on my experience auditing 40+ token contracts during the 2017 ICO frenzy, I saw the same pattern: basic code errors masked by marketing. This is worse. This is a protocol-level assumption that never existed in the threat model.
The Numbers Don't Lie
- 3.66 million EIP-7702 transactions in 3 months.
- 63% malicious.
- 242 identified malicious contracts.
- 500 pre-deployed CREATE2 contracts.
- $2.36M stolen.
- $10.14M exposed.
These aren't theoretical risks. They're audited, quantified, and published. The USENIX paper is a call to action. But the market hasn't reacted. Why?
Contrarian: What the Bulls Got Right
Let me play devil's advocate. The bulls will point to the 1.3 million legitimate transactions. They'll argue that EIP-7702 enabled gas-efficient batch operations, simplified multi-sig setups, and reduced the friction of migrating to a new wallet. They're not wrong. The upgrade did solve real UX problems.
They'll also argue that the attack surface is self-limiting. Once users understand the risks, they'll use whitelisting, hardware wallets, and delegation expiration. The attack rate will drop.
But here's the blind spot: the attack surface is not self-limiting. It's exponential. Every new wallet that supports EIP-7702 becomes a target. Every new DeFi protocol that assumes tx.origin is safe becomes a honeypot. The 500 pre-deployed contracts are a ticking time bomb. They don't expire. They wait.
The bull case assumes user education will solve the problem. It won't. The attack is not about user error. It's about protocol design. The delegation mechanism is too permissive. The default should be opt-in, not opt-out. The upgrade gave users power without the tools to manage it.
Takeaway: The Accountability Call
The Ethereum community must treat this as a systemic failure, not a minor bug. Wallet providers need to implement mandatory delegation whitelists. DeFi protocols must audit every tx.origin dependency. The EIP-7702 specification should be updated to include delegation expiration and revocation by default.
Otherwise, the code will keep executing. The metadata will keep lying. And the 500 sleeping dragons will wake up.
