Ethereum Wallet Delegation Feature Under Fire After Malicious Activity Exposed

A recent study has found that attackers were behind most of the early activity tied to Ethereum's EIP-7702 wallet delegation feature. The research, peer-reviewed and presented at USENIX Security '26, studied over 22.8 billion transactions across seven blockchains.

Of the 3,664,166 EIP-7702 authorization transactions through July 15, 2025, 63% were linked to contracts identified as malicious by the researchers. The team used transaction filters, code analysis, and manual review to confirm 924 malicious contracts overall.

The delegation feature allows a wallet address to point to separate contract code without changing the address itself. This setup lets wallets add features like batching multiple actions into one transaction or letting someone else pay the gas fee. However, if the linked code is faulty or written by an attacker, it can approve transfers, move funds, or interact with apps as if it were the account owner.

The study measured $2,362,848.76 in confirmed losses across three attack types. Researchers also found that attackers have prepared these authorizations ahead of time and gotten victims to sign them, sometimes through a wallet prompt that does not clearly show which code is being approved.