An Ethereum wallet has been drained through a malicious use of EIP-7702 account delegation. As of October 14, 2026, security firm ExVul reported that the wallet linked to sven.eth lost 9.1231 ETH, valued at approximately $22,700–$22,770, along with 1.69 TAPEETH tokens. The attacker used a previously signed EIP-7702 authorization to execute code in the victim’s account context and transfer the assets. No flash-loan or AMM manipulation was involved.
The incident continues to highlight emerging risks around new account-abstraction features. It has restricted recovery options once the authorization is active. Existing analysis attributes the loss to a signed delegation rather than a smart-contract bug in the related reward system. Security researchers rely partly on on-chain transaction data while routing warnings to users about clearing malicious delegations. This highlights the difference between traditional private-key compromises and authorization-based drains enabled by EIP-7702.
The Drivers of the Current Situation
The main issue is the abuse of an EIP-7702 authorization signed by the wallet owner. The authorization delegated the externally owned account to attacker-deployed code. The attacker then sponsored a transaction that activated the malicious delegate, allowing it to claim rewards and sweep the ETH balance in a single call. Addresses involved include the victim wallet, the malicious delegate contract, and the controlling attacker address.
Technical details have limited immediate mitigation for already-compromised accounts. Some reports note that the malicious delegation remained active after the drain, leaving the wallet vulnerable to further losses until the authorization is cleared or replaced. Only the on-chain execution path and the signed authorization have been publicly detailed. Broader patterns of EIP-7702-related drains have been observed in other cases, often linked to phishing or deceptive signing prompts.
Continued protection requires users to scrutinize delegation requests carefully. Limited awareness of the new authorization model forms a narrower path for prevention. Security firms and wallet providers are actively monitoring and alerting on such activity. The situation is a confirmed EIP-7702 delegation drain tied to a single user wallet.
Impact and Broader Context
Questions about an Ethereum user losing $22K in an EIP-7702 wallet attack keep growing. The incident creates uncertainty around the security implications of account-delegation features introduced with recent upgrades. It also serves as a practical example of how signed authorizations can be weaponized. Security researchers, wallet developers, and users continue to examine the attack pattern.
The issue drives debate on the risks accompanying greater account flexibility. It raises questions about how users are prompted to sign EIP-7702 authorizations, the limits of current wallet interfaces in surfacing risks, risks of reusable malicious delegate contracts, effects on user trust in new Ethereum features, and competition between convenience features and safer default behaviors. Stakeholders stress that the root cause was the signed authorization rather than a flaw in the reward contracts themselves. Official alerts advise against sending additional funds to compromised addresses and recommend clearing or replacing active malicious delegations.
The October 14 security alert forced rapid attention onto this specific drain. The current analysis shows how further incidents, improved wallet warnings, or educational efforts will influence user practices around EIP-7702.
New reports of similar attacks, updates from wallet providers, or refined best-practice guidance will clarify the scale of the risk and effective countermeasures.
This analysis uses the ExVul security alert and contemporaneous reporting on the incident. Exact loss valuations and any subsequent recovery efforts remain subject to on-chain confirmation and market prices at the time of the drain.