EIP-7702 sweeper attacks drain over $1.56M via malicious delegations
CIE News ·
Based on reporting by crypto.news; not yet independently confirmed.
Security researchers report that over $1.56 million has been stolen in Ethereum EIP-7702 exploits, using phished delegation signatures to give attackers execution control over victim accounts.
Attackers have stolen more than $1.56 million through delegation exploits targeting Ethereum accounts using EIP-7702 design features, according to security teams and researchers tracking the activity between October 14 and October 15, 2026. Security firm ExVul reported that an attacker used a sponsored type-4 transaction containing a phished EIP-7702 authorization on October 14, draining 9.1231 ETH worth about $22,770 and 1.69271471 TAPEETH tokens from a wallet tied to sven.eth.
Broader tracking indicated that over $1.54 million was taken across connected accounts, with 97% of the assets routed through a single attacker-controlled sweeper contract. Researcher Yu Xian noted that attackers weaponized compromised wallet permissions and delegation signatures following recent token launches to secure persistent account takeovers.
Under EIP-7702, externally owned accounts can designate smart contract code to run on their behalf. According to research published on arxiv.org, a single phished authorization tuple can give an attacker persistent control over an account, allowing remote triggers to repeatedly execute malicious code and sweep tokens without compromising underlying protocols.
Key facts
- $1.56M total stolen
- Ethereum EIP-7702 targeted
- Type-4 transactions used
- $22,770 lost by sven.eth
Read the original at crypto.news