Ethereum Wallets Fall Prey to Malicious Contracts

A study presented at USENIX Security '26 found that a significant number of Ethereum EIP-7702 wallet authorization transactions were linked to malicious contracts. The research analyzed over 3.6 million authorization transactions across seven blockchains through July 2025 and revealed that 63% of them were connected to attackers exploiting the new EIP-7702 feature. This feature allows wallets to act like smart contracts, which attackers used to their advantage.

The study also found that attackers exploited outdated contract assumptions, leaving $10.14 million in assets exposed. Furthermore, researchers noted that attackers would often rebind accounts to normal-looking code post-attack to hide the risks. To improve security, Ethereum developers now recommend stricter wallet vetting and clearer user warnings for delegated code.