EIP-7702 Delegation Attacks: How to Check If Your Wallet Is Exposed (October 2026)
EIP-7702 turns one routine-looking signature into full control of an Ethereum wallet — and drainers are industrializing it. On October 10, 2026, a victim signed a phishing batch transaction and lost approximately $1.54 million in staked ETH and BTC-pegged tokens. Four days later, on October 14, a wallet tied to sven.eth lost 9.1231 ETH (~$22,770) when an attacker activated a delegation the victim had signed weeks earlier. Wintermute research shows roughly 97% of malicious EIP-7702 delegations point to the same reusable sweeper contract, nicknamed CrimeEnjoyor. Here is how the attack works and how to check whether your wallet is exposed.
What is EIP-7702, exactly?
EIP-7702 shipped with Ethereum’s Pectra upgrade on May 7, 2025. It lets an externally owned account (a normal wallet address) temporarily point to smart contract code and run as a programmable wallet: batch transactions, sponsored gas, session keys — without migrating to a new address.
The feature is legitimate and useful. The risk is the size of the permission:
| Signature type | What it grants |
|---|---|
ERC-20 approve |
One token, up to the approved amount |
| Permit2 | One spender, specific tokens, revocable |
| EIP-7702 delegation | The entire account — every asset, every future deposit |
When you sign an EIP-7702 authorization, you are not approving a token. You are telling the network that a contract now speaks for your whole account. If that contract is hostile, it does not need a second signature.
How the drainer attack actually works
The attack chain has three moves:
- The bait. A phishing page or fake dApp presents a signature dressed up as something routine: “upgrade your wallet,” “enable gasless transactions,” “authorize the trading assistant,” or a swap with a hidden delegation bundled inside.
- The dormant signature. You sign an EIP-7702 authorization naming the attacker’s contract as your account’s delegate. The attacker can wait days or weeks until your wallet holds enough value.
- The sweep. The attacker submits a sponsored transaction — they pay the gas, so you never see a pending transaction — and the delegated code runs a batch: staking rewards claimed, tokens transferred, ETH withdrawn, all atomic. Once delegated, the sweeper auto-forwards every deposit that lands in the wallet.
SlowMist founder Yu Xian described the user experience bluntly: the user opens a phishing site, a signature prompt pops up, they click confirm, and with that one action every valuable asset in the wallet vanishes.
What are the red flags in a signature prompt?
Four tells that an EIP-7702 trap is in front of you:
- The words “delegate,” “authorize,” “set code,” or “upgrade” on a prompt from a site you did not navigate to yourself
- Transaction type 0x04 (SetCode) — EIP-7702 authorizations ride this type; if your wallet shows an unexplained SetCode, reject it
- An authorization naming a contract address, not a token — a normal approval names a token and a spender; a delegation names a contract that becomes your account
- Urgency framing — “upgrade now,” “before your wallet is deprecated,” countdown timers. Real wallet upgrades happen inside your wallet app, on your schedule
The honest rule: a legitimate dApp does not need to delegate your whole account to a contract you have never heard of. Swaps, mints, and approvals do not require it.
How do I check if my wallet is exposed?
Two checks, both free:
- revoke.cash → delegations tab. Connect your account (read-only is fine) and look at whether your address currently delegates to a contract, and which one. An unrecognized contract is a red flag.
- Etherscan → your address → transactions. Look for a SetCode authorization (transaction type 0x04) you did not knowingly make.
Crypto security researchers estimate that over 63% of early EIP-7702 authorizations observed on-chain pointed to harmful contracts, with roughly $2.36 million in confirmed losses and another $10.14 million in continued exposure sitting in wallets that signed risky delegations but have not been drained yet. Treat that figure as a research estimate, not an audited total — but the direction is clear.
How do I revoke a delegation I already signed?
Restoring your account means sending an EIP-7702 transaction that re-delegates to the zero address, which resets the code. Most wallets handle this from inside the wallet’s own interface — check your wallet provider’s official guidance. Until the delegation is cleared, treat every future deposit to that address as exposed.
If funds already moved, or you suspect the key itself is compromised, do not keep using the account: generate a fresh seed on a clean device and migrate what is left. And be wary of anyone offering guaranteed “fund recovery” for a fee — that is the second scam stacked on the first, a pattern we documented in fake Polymarket recovery services.
Does a hardware wallet protect against this?
Partially. Ledger’s Flex, Stax, Nano X, and Nano S Plus all support EIP-7702, and the device protects your private key from exposure — but it cannot judge whether a delegation is safe. It confirms what you sign, not whether you should sign it. Keep high-value holdings in a wallet that has never signed an EIP-7702 authorization, separate from a hot wallet used for dApp interaction.
How does this relate to Polymarket users?
The June 2026 Polymarket frontend incident taught the same lesson: the signature is the entire crime. Drainer kits like Inferno built their business on token allowances, which are scoped. EIP-7702 removes the scope — one signature now covers the whole account. The same defensive habit applies: read every prompt, reach dApps from bookmarks rather than ads or DMs, and check where approvals go before confirming.
FAQ
Is EIP-7702 itself a vulnerability? No. The standard works as designed; Safe’s product chief Rahul Rumalla notes it “was never meant to be a silver bullet” but has real use cases. The risk is in what users agree to sign.
How much has been lost to EIP-7702 drainers in 2026? No audited total exists. Reported single losses include ~$1.54 million (October 10, 2026) and ~$22,770 (October 14, 2026); a research estimate puts confirmed losses around $2.36 million with $10.14 million in continued exposure.
What is CrimeEnjoyor? The nickname Wintermute researchers gave to the reusable sweeper contract behind roughly 97% of malicious EIP-7702 delegations. It auto-forwards any ETH, NFTs, or tokens sent to a delegated address.
Can I check if my wallet already signed a malicious delegation? Yes — revoke.cash’s delegations tab, or Etherscan filtering for SetCode (type 0x04) authorizations on your address.
Educational content, not financial or security advice. Not affiliated with Polymarket or the Ethereum Foundation. Sources: Wintermute research, SlowMist, Scam Sniffer, ExVul (October 2026 reporting).
Last updated: October 15, 2026.
