EIP-7702 Wallet Drainer Campaign
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·W9qwNB…uGTASummary
A coordinated phishing and wallet-draining campaign has exploited Ethereum's EIP-7702 account abstraction feature — introduced in the May 2025 Pectra upgrade — to steal funds from ordinary wallets without requiring seed phrase access. Victims are tricked into signing a delegation authorization that grants attacker-controlled smart contract code full execution rights over their wallet; the authorization can sit dormant for days or weeks before being activated to drain all assets in a single atomic transaction. Researchers at Wintermute and Scam Sniffer have linked over 97% of malicious EIP-7702 delegations on Ethereum mainnet to copies of a single sweeper contract nicknamed 'CrimeEnjoyor,' indicating an organized operation rather than scattered individual actors. Confirmed losses as of mid-October 2026 include at least $1.54 million in a single October 2026 incident and an additional $22,770 on October 14, 2026, with total estimated campaign losses across all incidents exceeding $2.36 million and an estimated $10.14 million in further exposed wallets.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(9 events)
7 May 2025
Ethereum Pectra hard fork activates on mainnet, enabling EIP-7702 account abstraction feature for EOAs.
Cryptopolitan23 May 2025
Scam Sniffer reports an Ethereum user lost $146,550 after signing malicious batched EIP-7702 transactions — among the first confirmed losses on mainnet.
Crypto.news24 May 2025
A BNB Chain sweeper operator (address 0x02b1C6CAE421CEE79836f7A13cd2DD19f684a6be) is initially funded via a Bybit hot wallet with 0.75 BNB, according to the MetaMask community report.
MetaMask/core GitHub Issue #1068226 May 2025
GoPlus Security publishes a DeFiHackLabs analysis identifying a top-ranked EIP-7702 delegator (0x930fcc37d6042c79211ee18a02857cb1fd7f0d0b) as a phishing contract that auto-redirects any received ETH to a theft address.
DeFiHackLabs / GoPlus Security30 May 2025
Wintermute releases the 'CrimeEnjoyor' on-chain warning mechanism, reporting that over 97% of EIP-7702 delegations on mainnet use identical sweeper bytecode.
CoinTelegraph2 June 2025
CoinDesk reports Wintermute's finding that early CrimeEnjoyor sweepers had not yet successfully drained significant funds on mainnet, though the infrastructure was in place.
CoinDesk2 September 2025
SlowMist founder Yu Xian warns that World Liberty Financial (WLFI) token holders are being targeted by EIP-7702 phishing exploits. CoinDesk and multiple outlets report the campaign.
CoinDesk10 October 2026
Scam Sniffer reports a single Ethereum user loses approximately $1.54 million after signing malicious EIP-7702 batch transactions covering staked ETH and BTC-pegged tokens.
Shattered.io14 October 2026
ExVul reports that the wallet associated with ENS name sven.eth (0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28) lost 9.1231 ETH and 1.69271471 TAPEETH tokens (~$22,770) via a dormant EIP-7702 authorization activated by attacker address 0x9208097c007be15e28b20e94e66870a3f9f820bc.
Crypto.news / The Crypto TimesDecision Log
- slot 457333176 · hash Fc3prHSfUoeiz78FcYc1afBM6nE6b2wmFmFkFXuYSfzJ
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 0 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 10/15/2026, 6:12:22 PM
last updated: 10/15/2026, 6:12:22 PM
avoid.net — verified advice for a post-truth world