Attackers Dominate Early Use of Ethereum's New Smart Wallet Feature

Ethereum's new smart wallet feature, known as EIP-7702, was exploited by attackers who made up 63% of early use.

The feature allows a regular address to be programmable without moving assets, giving the delegated code power to act with account authority.

A peer-reviewed study found that malicious contracts were associated with 2,322,548 of the 3,664,166 EIP-7702 authorization transactions observed across seven chains through July 15, 2025.

The researchers tied a relatively small set of malicious contracts to repeated authorizations and described some attacker-controlled activity as likely practice or proof-of-concept testing during an early exploratory phase.