Attackers Exploit Vulnerability in Ethereum Smart Wallet Feature

A new smart wallet feature on Ethereum has been exploited by attackers who drove 63% of early use, according to a recent study. The feature, known as EIP-7702, allows users to programmatically delegate authority to a contract without moving their assets.

The study, which analyzed over 22.8 billion historical transactions on Ethereum and other chains, found that malicious contracts were associated with 2,322,548 of the 3,664,166 authorization transactions observed between May 7, 2025, and July 15, 2025.

The researchers tied a relatively small set of malicious contracts to repeated authorizations and described some attacker-controlled activity as likely proof-of-concept testing during an early exploratory phase. The study's authors noted that the risk reaches beyond hijacked wallets and identified $2.36 million in realized losses across its three attack categories.

The researchers emphasized that applications should not expect users to provide arbitrary authorization signatures due to a lack of a safe generic interface for users to assess code with unrestricted account access. Wallets are expected to vet the implementation, but may reduce decision-making to high-level prompts while obscuring contract addresses or code receiving authority.