Hook
366,000 transactions in three months. 63% of them malicious. That’s not a bug — that’s a systemic failure of a newly activated Ethereum upgrade. EIP-7702, the flagship account abstraction feature of the Pectra hard fork, went live on mainnet May 7, 2025. The data is now in, and it tells a story the marketing materials omitted. Check the calldata, not the headline.
Context
EIP-7702 allows externally owned accounts (EOAs) to temporarily delegate their code execution to a smart contract, effectively granting the EOA smart contract capabilities without changing its address. The promise: seamless UX upgrades, gas sponsorship, and batch transactions — all without migrating to a new wallet. The mechanism relies on a delegation designator embedded in the account’s code hash. Users sign a message authorizing a contract, and then all subsequent transactions from that account execute the delegated logic. The Ethereum Foundation and wallet providers hailed it as a step toward mass adoption. But a recent USENIX security study, analyzing 22.8 billion historical transactions, reveals a darker reality. The research team, which I have deep respect for given my own background auditing Zcash shielded transactions, uncovered a pattern of exploitation that undermines the upgrade’s core security assumptions.
Core
Let’s walk through the evidence chain. The researchers identified 242 distinct malicious contracts deployed solely to exploit EIP-7702 delegations. Another 500 contracts were created via CREATE2, designed to be deployed only when triggered. The attack surface is not theoretical: $2.36 million has been directly stolen from users who signed delegation messages to these contracts. An additional $10.14 million in assets remains exposed across wallets that have unknowingly delegated to malicious code. The modus operandi is straightforward: attackers craft phishing interfaces that request a blind signature for a delegation message. Once signed, the user’s EOA effectively hands over control of all future transactions to the attacker’s contract. The contract can then drain ERC-20 tokens, NFTs, or even ETH via selfdestruct-like mechanisms. What makes this particularly insidious is the “re-binding” attack: a user can revoke one delegation and authorize another, but the attacker’s contract can re-delegate itself before the user’s next transaction, creating a loop that is invisible to standard wallet UIs. Even after the user believes they have cleaned their account, the attacker’s code remains latent. The old security assumption that msg.sender == tx.origin is a reliable check for direct user interaction is now broken. Any DeFi protocol relying on that check for anti-phishing protection is vulnerable. During my work on DeFi liquidity forensics for meme coins, I learned that 85% of volume was wash trading — but here, the fraud is not volume, it’s authorization. The data shows that 63% of all EIP-7702 delegation transactions are malicious. That is not a marginal issue; it is a dominant use case. The upgrade’s designers assumed that users would only delegate to trusted contracts, but the on-chain reality is that attackers are faster than wallets in deploying phishing campaigns.
Contrarian
One might argue that EIP-7702 is still in its infancy, and that the high malicious rate is a temporary artifact of early adoption by attackers. But correlation does not equal causation. The asymmetry is fundamental: the upgrade reduces the cost of social engineering attacks from requiring a full transaction to requiring a single signature. The trust-minimization promise of Ethereum is inverted. Instead of a user controlling their private key as the sole authority, they now have a secondary authorization layer that can be hijacked. The paper’s data suggests that the attack vector is not a bug but a feature of the design. The real blind spot is the wallet infrastructure. Most wallets display a delegation request as a cryptic hexadecimal string, forcing users to sign blindly. The researchers found that even after “reverting” a delegation, the attacker’s contract can re-deploy itself via CREATE2 within the same block, effectively making revocation meaningless. The contrarian take is not that EIP-7702 is flawed beyond repair, but that the industry’s focus on UX improvement has blinded it to the new attack surface. Rug pulls are just math with bad intent. The math here is simple: the cost of creating a phishing contract is pennies; the potential reward is millions. Until wallets implement mandatory human-readable delegation previews and time-lock mechanisms, the upgrade is a net negative for security.
Takeaway
The next week signal is clear: watch for wallet providers to release emergency patches that add delegation revocation lists and real-time scanning of delegated code. If no major wallet announces such features within 30 days, the malicious transaction share will likely exceed 75%. The USENIX paper is not a warning — it is a post-mortem of a preventable failure. The Ethereum community must now decide whether to add a circuit breaker to EIP-7702 or accept that account abstraction comes with a permanent increase in phishing risk. The ledger is the ultimate witness. The data has spoken. Trust is a function of code, not words.