CrimeEnjoyor Sweeper Contract: The Malware Behind 97% of EIP-7702 Drains (2026)
Most EIP-7702 thefts trace back to a single piece of copy-pasted code. Wintermute researchers, who track EIP-7702 delegations on a public Dune dashboard, found that roughly 97% of malicious delegations on Ethereum mainnet point to the same reusable sweeper bytecode — the community nicknamed it CrimeEnjoyor, with near-identical clones tracked as CrimeEnjoyor2 and AdvancedCrimeEnjoyor. Understanding how this one contract works explains the whole drainer economy.
What is CrimeEnjoyor, mechanically?
CrimeEnjoyor is a short, redeployable sweeper contract. Once a victim’s account delegates to it via EIP-7702, the contract watches the address and automatically forwards anything that lands there:
| Asset that arrives | What the sweeper does |
|---|---|
| ETH (refund, sale, exchange withdrawal) | Instantly forwarded to the attacker |
| ERC-20 tokens | Swept in the same auto-forward pass |
| NFTs | Transferred out without confirmation |
There is no popup, no second signature, no window to react. The account becomes a pass-through pipe to the thief.
The industrial-scale campaign
Wintermute traced one campaign where attackers spent roughly 2.88 ETH (a few thousand dollars at the time) to authorize approximately 79,000 addresses against sweeper contracts. A single CrimeEnjoyor deployment handled delegations for over 52,000 of those addresses.
The economics matter as much as the scale: many of the 79,000 addresses were already-compromised, empty wallets whose keys had leaked elsewhere. For those, EIP-7702 delegation is not the break-in — it is an automated cleanup tool that scoops any future deposit. The campaign’s profit was far below what “79,000 victims” would suggest. SlowMist’s Yu Xian noted the mechanism is used most by coin-stealing groups rather than classic phishing crews.
Why concentration matters for defense
The drainer economy has industrialized: instead of bespoke exploit code per target, criminal groups deploy CrimeEnjoyor clones and distribute phishing links, letting one sweeper logic drain thousands of wallets at once. This has two defensive consequences:
- Detection is centralized too. Security tools can fingerprint the sweeper bytecode — a delegation to a known CrimeEnjoyor clone is a definitive compromise signal, not a heuristic.
- The pattern repeats across kits. Lucifer and the affiliates scattered after Pink Drainer’s shutdown bolted EIP-7702 onto the same drainer-as-a-service playbook within days of Pectra’s launch.
How do I know if my wallet delegates to CrimeEnjoyor?
The check is the same as for any hostile delegation: open revoke.cash’s delegations tab, or review your address’s transactions on Etherscan for a SetCode (type 0x04) authorization you did not knowingly make. Full walkthrough in our guide to EIP-7702 delegation attacks.
If your account delegates to an unrecognized contract — CrimeEnjoyor clone or anything else — re-delegate to the zero address to reset the code, and treat deposits to that address as exposed until it is cleared.
FAQ
Who found CrimeEnjoyor? Wintermute researchers, tracking EIP-7702 delegations on a public Dune dashboard; the nickname spread through the security community in 2026.
Is CrimeEnjoyor a virus on my computer? No. It is an on-chain contract. It only gets control if your address delegates to it — via a signature you signed or a leaked key.
Does CrimeEnjoyor steal immediately? Not always. It sweeps automatically when value arrives. Many accounts sit delegated and empty until a deposit triggers the forward.
Educational content, not security advice. Sources: Wintermute Dune research, SlowMist commentary (October 2026).
Last updated: October 15, 2026.
