EIP-7702 Wallet Attack Drains $22,770 in ETH
An EIP-7702 wallet attack drained 9.1231 ETH, worth about $22,770, and 1.69271471 TAPEETH from a wallet linked to sven.eth, according to security firm ExVul. The attacker reportedly used a sponsored Ethereum type-4 transaction to activate malicious code under an authorization signed by the wallet owner. The code enabled the attacker to claim TAPEETH rewards and withdraw ETH. ExVul said the incident did not involve a PodMining or TAPEETH vulnerability, flash loan or market manipulation. The malicious delegation was still active at Ethereum block 26,188,153 when the firm reported it, leaving the wallet exposed to further losses if new assets were deposited.
Neutral
The incident is negative for the affected wallet and highlights risks in Ethereum’s EIP-7702 delegation feature, but its direct market impact appears limited. The reported loss is small relative to the overall crypto market, and ExVul identified no exploit of PodMining or TAPEETH itself, nor any flash-loan or market-manipulation activity. Traders may respond in the short term by checking wallet permissions, avoiding suspicious authorization requests and scrutinizing tokens or applications that use delegated execution. Similar past warnings about malicious EIP-7702 delegations have raised security concerns, but such incidents have generally been account-specific rather than evidence of an Ethereum-wide failure. In the longer term, repeated wallet-draining cases could weigh on confidence in account-abstraction tools and increase demand for safer signing interfaces, permission monitoring and delegation-revocation features. Unless further evidence shows a broader vulnerability or a larger pattern of losses, the event alone is unlikely to materially shift ETH’s price or overall market stability.