Ethereum's New Smart Wallet Feature Hijacked by 63% of Early Users
A new study released at USENIX Security '26 found that attackers dominated early use of Ethereum's new smart wallet feature, EIP-7702.
The study analyzed over 22.8 billion historical transactions on seven chains and found that attacker-linked contracts were associated with 63% of the authorization transactions observed through July 15, 2025.
The researchers tied a relatively small set of malicious contracts to repeated authorizations and described some attacker-controlled activity as likely practice or proof-of-concept testing during an early exploratory phase.
EIP-7702 allows users to make their regular addresses programmable without moving their assets, while the delegated code gains power to act with that account's authority. This design can give a conventional wallet features associated with smart accounts, including batched calls and sponsored transactions, without forcing the user to migrate to a new address.
The study measured $2.36 million in realized losses across its three attack categories and identified 924 malicious contracts. It also found that attackers could prepare authorization fields off-chain and ask a victim to sign, making it essential for wallets to vet the implementation.