Dormant EIP-7702 authorization used weeks later to drain an Ethereum wallet
An Ethereum wallet holding TAPEETH mining rewards
On 14 October 2026 an attacker used an EIP-7702 authorization the victim had signed earlier to drain 9.1231 ETH (about $22,770) and TAPEETH rewards from an Ethereum wallet, ExVul reported. The attacker sponsored a type-4 transaction carrying the old signature, which made the victim's wallet run attacker code that claimed mining rewards and withdrew the ETH in one go. ExVul said the malicious delegation was still active afterwards and that TAPEETH and PodMining were not at fault. The case shows a 7702 signature can sit unused and be fired later.
Why this severity: $23K reported stolen, 1 victims, still active.
- Started
- Oct 14, 2026
- Chains
- Ethereum
- Reported stolen
- $23K
- Victims
- 1
Indicators · never visit or send to these
- 0x9208097c007be15e28b20e94e66870a3f9f820bc
- 0x0366b55f948a688888ca6e029ad0831f6ec260d1
What to do now
- If the delegate contract is not one your wallet app set, move funds to a new wallet right away.
- Revoke or reset the delegation from a trusted wallet if possible.
Stay safe
Am I affected?
If you ever signed an EIP-7702 authorization from a website, open your address on a block explorer and check whether it is delegated to a contract. A delegation stays in force until you change it, even if nothing happened for weeks.
What to do now
- If the delegate contract is not one your wallet app set, move funds to a new wallet right away.
- Revoke or reset the delegation from a trusted wallet if possible.
How to avoid this
- Never sign 'upgrade account', 'enable batching' or similar authorization prompts that come from a site rather than your wallet.
- Remember that one signature can be used later by anyone who pays the gas.
- Use a wallet that shows and lets you clear active 7702 delegations.
Timeline 2
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
Since Ethereum's Pectra upgrade, a normal wallet can delegate itself to smart-contract code. Sign a malicious delegation and that code can do anything with your wallet. Read about eip-7702 delegation phishing →
Follow new drains and updates in your feed reader or Telegram RSS bot.