A new peer-reviewed security study has found that attackers controlled the majority of early transactions using Ethereum's EIP-7702 feature, a wallet upgrade that went live in May 2025. Researchers presenting findings at USENIX Security '26 discovered that 63% of authorization transactions tied to the feature were linked to malicious contracts, raising urgent questions about how safely the innovation has been rolled out across the ecosystem.

What Is EIP-7702 and Why Does It Matter?

EIP-7702 is a feature introduced during Ethereum's Pectra hard fork on May 7, 2025, that lets a standard wallet temporarily behave like a smart contract without changing the wallet's address itself. The upgrade was designed to make wallets more flexible by enabling users to batch multiple transactions into a single action or allow third parties to cover gas fees on their behalf. However, the same flexibility that makes the feature appealing has created a new attack surface that bad actors have been quick to exploit.

Under EIP-7702, the original owner keeps their private key, but the contract code linked to that address gains full authority over the account. This means the linked code can move funds, approve transfers, or interact with other applications exactly as if the account holder had given direct instructions. The problem is that if the code is poorly written or deliberately malicious, users have no realistic way to know what they're actually approving.

How Widespread Is the Attacker Involvement?

The scale of the study gives the findings real weight. Researchers processed more than 22.8 billion transactions spanning seven blockchains, including Ethereum, Binance Smart Chain, Polygon, Optimism, Arbitrum, Base, and Gnosis, all through July 15, 2025. Within that massive dataset, they isolated 3,664,166 EIP-7702 authorization transactions specifically.

Out of those authorization transactions, 2,322,548 of them, or 63%, were linked to contracts the team identified as malicious. Researchers used a combination of transaction filters, code analysis, and manual verification to confirm 924 distinct malicious contracts. The team describes this number as a floor rather than a ceiling, since their method may not catch newer contracts or unfamiliar attack patterns.

To put this in perspective, that means for every ten people who signed an EIP-7702 authorization in this window, roughly six were interacting with code tied to attackers. This isn't a small sample pulled from a handful of suspicious wallets, but a systematic sweep across the chains where the feature is actually being used.

What Attack Methods Are Attackers Using?

Attackers have developed several techniques to exploit EIP-7702's design. According to the study, attackers prepare these authorizations in advance and then convince victims to sign them, sometimes through wallet prompts that don't clearly disclose which code is actually being approved. In some cases, the wallet interface fails to show users what they're actually delegating authority to.

One particularly troubling finding involves attackers rebinding an account to normal-looking code after an attack, which erases the obvious signs of compromise. Anyone checking that wallet later would see nothing unusual, even though the account had already been exploited. The research team also flagged 500 delegation targets pointing to addresses where no code has been deployed yet, meaning malicious code could theoretically be added later while the recorded delegation target stays exactly the same.

What Is the Financial Damage So Far?

The confirmed damage from these attacks sits at $2,362,848.76, according to the study's own tally, spread across three distinct attack types. That figure only counts what researchers could independently verify, so the real total tied to EIP-7702 vulnerabilities may run higher.

Beyond the direct losses, researchers identified a separate and arguably more unsettling risk. They found 967 active Ethereum contracts built before EIP-7702 existed that still rely on the outdated assumption that a wallet address could never behave like a smart contract. That assumption broke the moment the Pectra upgrade activated. These legacy contracts are collectively exposing about $10.14 million in assets to potential risk.

How to Protect Yourself From EIP-7702 Risks

• Verify Delegation Targets: Before signing any EIP-7702 authorization, demand that your wallet clearly show you exactly which contract code you are delegating authority to. Do not approve any authorization if the wallet cannot display this information clearly.
• Use Whitelisted Contracts Only: Ethereum.org has recommended that wallets whitelist delegation contracts and only accept authorizations from publicly reviewed, audited smart account implementations rather than accepting arbitrary delegation requests from any application.
• Understand the Code You Approve: If possible, review the contract code you are delegating to or consult security documentation. Avoid delegating to newly deployed contracts with no track record or public audit.
• Limit Delegation Scope: Consider using a multisignature setup that combines independently designed devices and independently generated entropy, which provides meaningful defense in depth by reducing reliance on any single implementation.

What Are Experts Recommending?

"Wallets should whitelist delegation contracts, show users exactly which code they're approving, and rely only on audited smart account implementations rather than accepting arbitrary delegation requests from any application," according to guidance issued by Ethereum.org in response to the study's findings.

Ethereum.org Security Guidance

Beyond individual wallet fixes, there's a broader proposal circulating among developers: limit wallets to a short list of publicly reviewed, vetted account systems rather than letting any app request custom delegation code. That approach would narrow the attack surface considerably, though it would also mean giving up some of the flexibility that made EIP-7702 appealing in the first place.

The core recommendation from Ethereum.org treats wallet-level transparency as the first line of defense. If a user can't see what code an authorization actually delegates to, they have no realistic way to judge whether signing it is safe, which is precisely the blind spot attackers have been exploiting.

What Does This Mean for Ethereum's Future?

For now, the tension between convenience and wallet authorization security remains unresolved, and it's likely to shape how quickly and how cautiously the rest of the ecosystem adopts EIP-7702. The feature was meant to make Ethereum wallets more user-friendly, but the early data suggests that without stronger safeguards, it may have introduced more risk than benefit for everyday users.

The study underscores a broader lesson in blockchain security: new features that increase flexibility often increase attack surface as well. The challenge for wallet developers and the Ethereum community is to find a way to preserve the benefits of EIP-7702 while closing the gaps that attackers have already learned to exploit.