Ethereum User Loses $22K in EIP-7702 Wallet Attack

An Ethereum wallet linked to sven.eth suffered a loss of 9.1231 ETH—valued at approximately $22,770 at the time of detection—alongside 1.69271471 TAPEETH tokens. According to blockchain security firm ExVul, the incident occurred after an attacker utilized a malicious EIP-7702 authorization to gain control over the account.

ExVul reported the incident on October 14, detailing an attacker-sponsored transaction that executed pre-authorized malicious code through the victim's wallet. Investigators confirmed that the compromise stemmed from an unsafe wallet delegation rather than a vulnerability in the underlying PodMining protocol or TAPEETH tokens. No flash loans or Automated Market Maker manipulations were involved in the attack.

Attack Mechanics

The exploit involved a sponsored type-4 Ethereum transaction containing an EIP-7702 authorization signed by the victim. EIP-7702 allows externally owned accounts to temporarily execute smart contract functionality through delegated code. Once the Ethereum network processed the signed authorization, subsequent calls to the affected wallet executed the delegated instructions within the account context.

The attacker-controlled code invoked the PodMining.claim() function, transferred the resulting TAPEETH rewards, and withdrew the wallet's ETH balance. ExVul identified the attacker-controlled address as 0x9208097c007be15e28b20e94e66870a3f9f820bc and the transaction hash as 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee.

Active Delegation Risks

Security analysts warned that setting an EIP-7702 delegation does not automatically remove it when a transaction finishes. ExVul observed that the malicious delegation remained active at Ethereum block 26,188,153.

The security firm cautioned users against transferring new funds into compromised addresses while suspicious delegations remain active. Wallet owners retain control through their private keys and can reset delegations by authorizing the zero address, though security experts recommend moving remaining assets to a secure wallet.

Key facts

• An Ethereum wallet lost 9.1231 ETH, valued at about $22,770, and 1.69271471 TAPEETH tokens.
• Security firm ExVul attributed the theft to an unsafe EIP-7702 account delegation rather than a protocol vulnerability.
• The malicious delegation remained active at Ethereum block 26,188,153.
• The attack utilized a sponsored type-4 Ethereum transaction to invoke the PodMining.claim() function.