It's a bug, not a feature: bots use Ethereum's “Pectra” upgrade EIP-7702 to drain wallets

Ethereum’s May 2025 Pectra upgrade introduced EIP-7702, a new transaction type that lets externally owned accounts (EOAs) temporarily behave like smart contracts by delegating execution to a contract via a signed message. This was designed to enable account abstraction features such as gasless transactions, batching, and advanced wallet logic without forcing users to migrate to full smart contract wallets. Under EIP-7702, a user can sign a special “delegation” message that sets code for their account for the duration of a transaction, effectively allowing that account to execute arbitrary contract logic. Security researchers and onchain analysts have since highlighted that this same mechanism is being systematically abused by wallet-draining bots and phishers. Because a single offchain delegation signature can install attacker-controlled code on a user’s account, any compromised or tricked private key (for example, via phishing websites or malicious dapps) can be used to redirect funds to an attacker without the victim ever signing a normal onchain transfer. Data cited by blockchain security firm Wintermute and others indicates that more than 80% of EIP-7702 delegations observed onchain are tied to “sweeper” contracts used by malicious actors to empty wallets whose keys have been exposed. The issue is not a consensus bug in Ethereum itself but a powerful new feature that dramatically increases the damage potential once a private key or signature is compromised, prompting calls for stronger key security, clearer wallet UX around delegation messages, and broader user education about not signing unfamiliar EIP-7702-style messages.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Ethereum's Pectra Update Feature EIP-7702 Becomes a Tool for ... (binance.com)
• Pectra-Upgrade auf Ethereum: Hacker können Wallets mit Offchain ... (de.tradingview.com)
• Ethereum Pectra Upgrade: What Changed and Why It Matters - Ledger (ledger.com)
• Ethereum's Pectra Upgrade: What It Means for Reown and Why ... (reown.com)
• Pectra Upgrade & EIP-7702 Give EOAs Smart Wallet Superpowers (circle.com)

Explore the topic

• Ethereum Upgrade
• Pectra