Verify a decision

{"actor":"system:backfill","investigation_id":"3cfc115d-ba12-4942-bd09-3e8bf8fd6867","kind":"publish","page_slug":"eip-7702-wallet-drainer-campaign","published_at":"2026-10-15T18:12:31.712Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"EIP-7702 Wallet Drainer Campaign","sections":[{"content":"EIP-7702 is an Ethereum Improvement Proposal activated as part of the Pectra hard fork on May 7, 2025. The feature allows externally owned accounts (EOAs) — conventional wallets controlled by private keys — to temporarily execute smart contract code without changing their wallet address. Intended use cases include batching multiple transactions into one, allowing a third party to sponsor gas fees, and enabling passkey-based authentication. The feature works by letting a wallet owner sign a typed authorization that points the wallet's code to an existing smart contract for the duration of a transaction. Security researchers flagged potential abuse vectors before and immediately after Pectra's activation, noting that a malicious authorization could grant an attacker-controlled contract full execution rights over the wallet.","heading":"Background: EIP-7702 and the Pectra Upgrade","severity":"medium","sources":[{"credibility":2,"name":"Urgent security risk: Ethereum's EIP-7702 Pectra already infected by phishing scammers — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/phishing-scammers-infect-eip-7702-pectra/"},{"credibility":2,"name":"EIP-7702 wallet security: what auditors check after Pectra — Zealynx","type":"research","url":"https://www.zealynx.io/research/smart-contracts/eip-7702-wallet-security"},{"credibility":2,"name":"Beware the Pectra Trap: How EIP-7702 Delegation Is Fueling a New Wave of Wallet Drainers — EconoTimes","type":"news_article","url":"http://www.econotimes.com/Beware-the-Pectra-Trap-How-EIP-7702-Delegation-Is-Fueling-a-New-Wave-of-Wallet-Drainers-1754884"}]},{"content":"The attack follows a consistent pattern. A victim is presented with what appears to be a routine transaction — a token approval, a staking claim, an airdrop collection, or an interaction with a fraudulent DeFi interface mimicking a legitimate platform such as Uniswap. The underlying transaction is a type-4 EIP-7702 authorization that delegates the wallet's code pointer to an attacker-controlled smart contract. Once signed, the authorization persists on-chain indefinitely unless the victim explicitly revokes it using their original private key. The attacker can activate the dormant authorization at any later time by sponsoring a type-4 transaction on the victim's behalf — meaning the attacker, not the victim, pays the gas fee, removing a traditional warning signal. Upon activation, the malicious contract executes a batch operation that drains ETH, ERC-20 tokens, and NFTs in a single atomic transaction that the victim never approved in real time. Crucially, no seed phrase is required; a single historical signature is sufficient. Researchers note that a delegation that remained active after theft at block 26,188,153 continued to expose the victim to further loss.","heading":"Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"EIP-7702 Wallet Drainers Steal $1.54M in Ethereum — Shattered.io","type":"news_article","url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"},{"credibility":2,"name":"Ethereum Wallet Loses $22.7K in EIP-7702 Delegation Attack — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/14/ethereum-wallet-loses-22-7k-in-eip-7702-delegation-attack/"},{"credibility":2,"name":"EIP-7702 Delegation Phishing Scam: Why Revoking Fails — FlowSeekerLab","type":"research","url":"https://flowseekerlab.io/eip-7702-delegation-phishing-scam/"}]},{"content":"Wintermute's research team found that over 97% of EIP-7702 delegations in their analyzed dataset on Ethereum mainnet pointed to contracts sharing identical bytecode. This code cluster was given the informal name 'CrimeEnjoyor' by Wintermute researchers, who injected a visible warning string into verified copies of the malicious contracts as a detection mechanism. The sweeper contracts are designed to claim staking rewards, transfer ERC-20 tokens, and withdraw ETH without manual intervention once triggered. According to reporting by Scam Sniffer, one campaign variant saw attackers spend approximately 2.88 ETH to pre-authorize roughly 79,000 addresses against sweeper contracts, with a single contract handling delegations for more than 52,000 of those addresses. Many of the 79,000 addresses were already-compromised empty wallets with previously leaked keys, used as staging targets. A separate multi-chain operation reported to the MetaMask repository used a 'Forwarder' delegation pattern across BNB Chain, Base, and Optimism, conducting approximately 1.23 million transactions on BNB Chain alone; that operator's address (0x02b1C6CAE421CEE79836f7A13cd2DD19f684a6be) was initially funded via a Bybit hot wallet. Attribution beyond organized phishing-as-a-service groups has not been publicly established by law enforcement as of the date of this report.","heading":"CrimeEnjoyor Sweeper Contract and Campaign Attribution","severity":"critical","sources":[{"credibility":2,"name":"Wintermute warns Pectra upgrade leaves Ethereum users at risk of automated attacks — The Block","type":"research","url":"https://www.theblock.co/news/ecosystems/2025-06-01-wintermute-warns-pectra-upgrade-leaves-ethereum-users-at-risk-of-automated-attacks-356481"},{"credibility":1,"name":"Ethereum 'CrimeEnjoyors' Aren't Making Money From Exploiting Pectra's EIP-7702, Wintermute Says — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/06/02/post-pectra-upgrade-malicious-ethereum-contracts-are-trying-to-drain-wallets-but-to-no-avail-wintermute"},{"credibility":2,"name":"Active EIP-7702 sweeper operation on BNB Chain, Base, Optimism — MetaMask/core GitHub Issue #10682","type":"community_report","url":"https://github.com/MetaMask/core/issues/10682"},{"credibility":2,"name":"EIP-7702 Wallet Drainers Steal $1.54M in Ethereum — Shattered.io","type":"news_article","url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"}]},{"content":"The following incidents have been reported by named security firms and covered by crypto news outlets. On October 10, 2026, Scam Sniffer reported that a single Ethereum user lost approximately $1.54 million after signing several malicious EIP-7702 batch transactions covering ETH and BTC-pegged tokens. On October 14, 2026, security firm ExVul disclosed that the wallet associated with ENS name sven.eth (address 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28) lost 9.1231 ETH and 1.69271471 TAPEETH tokens, valued at approximately $22,770. ExVul attributed the loss to an unsafe delegation; the attacker address was identified as 0x9208097c007be15e28b20e94e66870a3f9f820bc and the malicious delegation contract as 0x0366b55f948a688888ca6e029ad0831f6ec260d1. ExVul confirmed the wallet was not drained through an exploit of the underlying DeFi protocol, but through the authorized delegation itself. Earlier in 2025, a user lost approximately $146,550 in May after signing malicious batch transactions, as reported by Scam Sniffer. In September 2025, SlowMist founder Yu Xian warned that holders of World Liberty Financial (WLFI) tokens were being targeted by the same class of EIP-7702 phishing exploit. Research cited by The Crypto Times and Shattered.io puts total confirmed losses at approximately $2.36 million, with an additional $10.14 million estimated at risk in wallets carrying active malicious delegations.","heading":"Confirmed Incidents and Financial Losses","severity":"critical","sources":[{"credibility":2,"name":"EIP-7702 Wallet Drainers Steal $1.54M in Ethereum — Shattered.io","type":"news_article","url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"},{"credibility":2,"name":"Ethereum user loses $22K in EIP-7702 wallet attack — Crypto.news","type":"news_article","url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/"},{"credibility":2,"name":"Ethereum Wallet Loses $22.7K in EIP-7702 Delegation Attack — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/14/ethereum-wallet-loses-22-7k-in-eip-7702-delegation-attack/"},{"credibility":1,"name":"WLFI Holders Targeted as Hackers Use Ethereum's EIP-7702 Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/09/02/holders-of-trump-s-crypto-token-targeted-by-hackers-in-phishing-exploit"},{"credibility":2,"name":"Security analysts warn about EIP-7702 flaw after user loses $1.54M — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/eip-7702-user-loses-1-54m-phishing-attack/"}]},{"content":"Traditional crypto security guidance — protect your seed phrase, revoke token approvals, check contract addresses — does not fully address the EIP-7702 delegation attack vector. Because the exploit requires only a signed authorization (not a private key exposure), a user can follow standard hygiene and still be compromised if they sign a malicious type-4 transaction. The delegation, once active, persists until explicitly revoked by the wallet owner using their private key. An attacker can activate the dormant authorization using a sponsored transaction, meaning the victim sees no gas-fee prompt to warn them. Standard token approval revocation tools do not revoke EIP-7702 delegations. Wallet interfaces that do not clearly distinguish type-4 authorization requests from ordinary transactions contribute to the risk, as users may not recognize the significance of what they are signing.","heading":"Why Standard Security Advice Is Insufficient","severity":"high","sources":[{"credibility":2,"name":"EIP-7702 Wallet Drainers Steal $1.54M in Ethereum — Shattered.io","type":"news_article","url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"},{"credibility":2,"name":"EIP-7702 Delegation Check: Foreign Code on Your Address — CryptoTicker","type":"research","url":"https://cryptoticker.io/en/eip-7702-delegation-check/"},{"credibility":2,"name":"EIP-7702 wallet security: what auditors check after Pectra — Zealynx","type":"research","url":"https://www.zealynx.io/research/smart-contracts/eip-7702-wallet-security"}]},{"content":"Wintermute developed the 'CrimeEnjoyor' detection mechanism to inject visible warning strings into verified malicious contracts on-chain, aiding researchers and wallet providers in identifying sweeper deployments. MetaMask received a community report (issue #10682) documenting the multi-chain sweeper operation and the associated operator addresses. Community tools such as the open-source 'sweepcheck' repository allow users to inspect whether an EIP-7702 sweeper is attached to their address without providing private keys. The GoPlus Security team, writing via DeFiHackLabs, advised users to verify that any EIP-7702 delegator contract is open-source and auditable before signing, and to treat any authorization request arriving via email or external URL as high-risk. Security researchers recommend that affected users stop depositing funds to compromised wallets, revoke the malicious delegation using their original private key, and transfer remaining assets to a fresh wallet. Ethereum wallet providers are under pressure from researchers to improve UI disclosure of type-4 authorization requests to make the delegation nature of the transaction visible to non-technical users.","heading":"Industry Response and Mitigations","severity":"medium","sources":[{"credibility":1,"name":"Wintermute's new code flags wallet-draining contracts — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/wintermute-crimeenjoyor-flags-malicious-ethereum-contracts"},{"credibility":2,"name":"Active EIP-7702 sweeper operation on BNB Chain, Base, Optimism — MetaMask/core GitHub Issue #10682","type":"community_report","url":"https://github.com/MetaMask/core/issues/10682"},{"credibility":2,"name":"Top 7702 Delegator Revealed as Phishing Scam — GoPlus Security via DeFiHackLabs","type":"research","url":"https://defihacklabs.substack.com/p/top-7702-delegator-revealed-as-phishing"},{"credibility":3,"name":"sweepcheck — open-source EIP-7702 delegation checker (GitHub)","type":"other","url":"https://github.com/cantstop113/sweepcheck"},{"credibility":2,"name":"Ethereum Wallet Loses $22.7K in EIP-7702 Delegation Attack — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/14/ethereum-wallet-loses-22-7k-in-eip-7702-delegation-attack/"}]}],"sources_used":[{"credibility":2,"name":"EIP-7702 Wallet Drainers Steal $1.54M in Ethereum — Shattered.io","type":"news_article","url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"},{"credibility":2,"name":"Ethereum user loses $22K in EIP-7702 wallet attack — Crypto.news","type":"news_article","url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/"},{"credibility":2,"name":"Ethereum Wallet Loses $22.7K in EIP-7702 Delegation Attack — The Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/10/14/ethereum-wallet-loses-22-7k-in-eip-7702-delegation-attack/"},{"credibility":1,"name":"Ethereum 'CrimeEnjoyors' Aren't Making Money From Exploiting Pectra's EIP-7702, Wintermute Says — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2025/06/02/post-pectra-upgrade-malicious-ethereum-contracts-are-trying-to-drain-wallets-but-to-no-avail-wintermute"},{"credibility":1,"name":"WLFI Holders Targeted as Hackers Use Ethereum's EIP-7702 Exploit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/09/02/holders-of-trump-s-crypto-token-targeted-by-hackers-in-phishing-exploit"},{"credibility":1,"name":"Wintermute's new code flags wallet-draining contracts — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/wintermute-crimeenjoyor-flags-malicious-ethereum-contracts"},{"credibility":2,"name":"Wintermute warns Pectra upgrade leaves Ethereum users at risk — The Block","type":"research","url":"https://www.theblock.co/news/ecosystems/2025-06-01-wintermute-warns-pectra-upgrade-leaves-ethereum-users-at-risk-of-automated-attacks-356481"},{"credibility":2,"name":"Top 7702 Delegator Revealed as Phishing Scam — GoPlus Security via DeFiHackLabs","type":"research","url":"https://defihacklabs.substack.com/p/top-7702-delegator-revealed-as-phishing"},{"credibility":2,"name":"Active EIP-7702 sweeper operation on BNB Chain, Base, Optimism — MetaMask/core GitHub Issue #10682","type":"community_report","url":"https://github.com/MetaMask/core/issues/10682"},{"credibility":2,"name":"Urgent security risk: EIP-7702 Pectra already infected by phishing scammers — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/phishing-scammers-infect-eip-7702-pectra/"},{"credibility":2,"name":"Security analysts warn about EIP-7702 flaw after user loses $1.54M — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/eip-7702-user-loses-1-54m-phishing-attack/"},{"credibility":2,"name":"EIP-7702 Transactions Surge After Ethereum's Pectra Upgrade — BeInCrypto","type":"news_article","url":"https://beincrypto.com/eip-7702-ethereum-pectra-phishing-risks/"},{"credibility":2,"name":"EIP-7702 wallet security: what auditors check after Pectra — Zealynx","type":"research","url":"https://www.zealynx.io/research/smart-contracts/eip-7702-wallet-security"},{"credibility":2,"name":"EIP-7702 Delegation Check: Foreign Code on Your Address — CryptoTicker","type":"research","url":"https://cryptoticker.io/en/eip-7702-delegation-check/"},{"credibility":2,"name":"EIP-7702 Delegation Phishing Scam: Why Revoking Fails — FlowSeekerLab","type":"research","url":"https://flowseekerlab.io/eip-7702-delegation-phishing-scam/"},{"credibility":3,"name":"sweepcheck — open-source EIP-7702 delegation checker (GitHub)","type":"other","url":"https://github.com/cantstop113/sweepcheck"},{"credibility":2,"name":"EIP-7702 Phishing Attack — arXiv academic preprint","type":"research","url":"https://arxiv.org/html/2512.12174v1"}],"summary":"A coordinated phishing and wallet-draining campaign has exploited Ethereum's EIP-7702 account abstraction feature — introduced in the May 2025 Pectra upgrade — to steal funds from ordinary wallets without requiring seed phrase access. Victims are tricked into signing a delegation authorization that grants attacker-controlled smart contract code full execution rights over their wallet; the authorization can sit dormant for days or weeks before being activated to drain all assets in a single atomic transaction. Researchers at Wintermute and Scam Sniffer have linked over 97% of malicious EIP-7702 delegations on Ethereum mainnet to copies of a single sweeper contract nicknamed 'CrimeEnjoyor,' indicating an organized operation rather than scattered individual actors. Confirmed losses as of mid-October 2026 include at least $1.54 million in a single October 2026 incident and an additional $22,770 on October 14, 2026, with total estimated campaign losses across all incidents exceeding $2.36 million and an estimated $10.14 million in further exposed wallets.","timeline":[{"date":"2025-05-07","event":"Ethereum Pectra hard fork activates on mainnet, enabling EIP-7702 account abstraction feature for EOAs.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/phishing-scammers-infect-eip-7702-pectra/"},{"date":"2025-05-23","event":"Scam Sniffer reports an Ethereum user lost $146,550 after signing malicious batched EIP-7702 transactions — among the first confirmed losses on mainnet.","source":"Crypto.news","source_url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/"},{"date":"2025-05-24","event":"A BNB Chain sweeper operator (address 0x02b1C6CAE421CEE79836f7A13cd2DD19f684a6be) is initially funded via a Bybit hot wallet with 0.75 BNB, according to the MetaMask community report.","source":"MetaMask/core GitHub Issue #10682","source_url":"https://github.com/MetaMask/core/issues/10682"},{"date":"2025-05-26","event":"GoPlus Security publishes a DeFiHackLabs analysis identifying a top-ranked EIP-7702 delegator (0x930fcc37d6042c79211ee18a02857cb1fd7f0d0b) as a phishing contract that auto-redirects any received ETH to a theft address.","source":"DeFiHackLabs / GoPlus Security","source_url":"https://defihacklabs.substack.com/p/top-7702-delegator-revealed-as-phishing"},{"date":"2025-05-30","event":"Wintermute releases the 'CrimeEnjoyor' on-chain warning mechanism, reporting that over 97% of EIP-7702 delegations on mainnet use identical sweeper bytecode.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/wintermute-crimeenjoyor-flags-malicious-ethereum-contracts"},{"date":"2025-06-02","event":"CoinDesk reports Wintermute's finding that early CrimeEnjoyor sweepers had not yet successfully drained significant funds on mainnet, though the infrastructure was in place.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2025/06/02/post-pectra-upgrade-malicious-ethereum-contracts-are-trying-to-drain-wallets-but-to-no-avail-wintermute"},{"date":"2025-09-02","event":"SlowMist founder Yu Xian warns that World Liberty Financial (WLFI) token holders are being targeted by EIP-7702 phishing exploits. CoinDesk and multiple outlets report the campaign.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2025/09/02/holders-of-trump-s-crypto-token-targeted-by-hackers-in-phishing-exploit"},{"date":"2026-10-10","event":"Scam Sniffer reports a single Ethereum user loses approximately $1.54 million after signing malicious EIP-7702 batch transactions covering staked ETH and BTC-pegged tokens.","source":"Shattered.io","source_url":"https://shattered.io/eip-7702-wallet-drainer-1-54-million-2026/"},{"date":"2026-10-14","event":"ExVul reports that the wallet associated with ENS name sven.eth (0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28) lost 9.1231 ETH and 1.69271471 TAPEETH tokens (~$22,770) via a dormant EIP-7702 authorization activated by attacker address 0x9208097c007be15e28b20e94e66870a3f9f820bc.","source":"Crypto.news / The Crypto Times","source_url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/"}]},"v":1}