Key Highlights:
- An Ethereum user lost approximately 9.1231 Ethereum, worth around $22.77K, along with 1.69 TAPEETH after an attacker used a signed EIP-7702 authorization to drain the wallet in one sponsored transaction.
- The root cause was a malicious delegation that allowed attacker-controlled code to run in the victim’s account context and sweep all funds.
- The malicious delegation remained active afterwards.
An Ethereum user associated with the ENS name sven.eth lost approximately 9.1231 Ethereum (ETH), valued at about $22,770, along with 1.69 TAPEETH tokens in a wallet drain that exploited the network’s EIP-7702 feature.
ExVul first noticed the security incident and shared an alert on October 14 detailing the incident. According to ExVul’s official tweet, the incident occurred through a sponsored type-4 transaction.
The attack did not involve flash loans or automated market maker manipulation. Instead, the attacker used a previously signed EIP-7702 authorization from the victim to take control of the account and sweep its assets in a single call.
“No Flash Loan Attack”, Security Firm Explains
According to ExVul, the root cause was not a vulnerability in the TAPEETH token or the PodMining protocol. Instead, the victim had signed an authorization that delegated their externally owned account to the attacker-deployed code at the address “0x0366b55f948a688888ca6e029ad0831f6ec260d1.”
Once activated through EIP-7702, any calls to the victim’s address executed that malicious code in the context of sven.eth’s account. This allowed a hard-coded controller at 0x9208097c007be15e28b20e94e66870a3f9f820bc to invoke PodMining.claim (), transfer the newly minted TAPEETH reward, and send out the entire ETH balance.
The attack transaction is recorded at 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee. These are some major addresses:
- Attacker: 0x9208097c007be15e28b20e94e66870a3f9f820bc
- Victim (sven.eth): 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28
- Malicious EIP-7702 delegate: 0x0366b55f948a688888ca6e029ad0831f6ec260d1
ExVul noted that the malicious delegation remained active at block 26,188,153. The firm warned users not to send funds to the victim’s address and urged the owner to clear or replace the delegation and migrate any remaining assets immediately.
On-chain analysis later showed the attacker had also drained smaller amounts from at least 16 other addresses. In an apparent consolidation error, the attacker later sent roughly 9.5769 ETH back to sven.eth, which included funds taken from those other victims. This return was not intentional restitution.
EIP-7702, introduced with Ethereum’s Pectra upgrade in May 2022, allows an ordinary wallet to temporarily behave like a smart contract account. A single signed authorization can delegate execution rights to external code. The feature enables useful functions such as transaction batching and gas sponsorship, but it also creates a new attack surface.
Once a malicious delegation is active, the attacker can execute code inside the victim’s account context without needing further signatures from the owner. New deposits can be swept automatically. Clearing the delegation requires the legitimate owner to sign a new authorization that points to the zero address, which resets the code hash without moving funds.
Earlier, security researchers have highlighted the risks associated with EIP-7702. Wintermute earlier found that a large majority of early EIP-7702 delegations pointed to the same family of sweeper contracts. Individual cases have included losses exceeding $1.5 million from a single batch signature in earlier incidents.
Crypto Wallets Suffer Major Security Incidents
The sven.eth drain comes amid heightened attention to wallet security. In early October 2026, on-chain investigators reported losses estimated between $86 million and $102 million linked to Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis. Ledger confirmed an unauthorized hardware implant in at least one affected device that could read recovery phrases from the screen during setup and transmit them.
Earlier this year, Ledger also suffered a major data breach, according to ZachXBT.
Apart from this, on October 9 and 10, approximately $3.55 million in previously unclaimed bridge funds was claimed and transferred using valid EIP-7702 delegations on an Ethereum externally owned account. BlockSec Phalcon flagged the activity but noted that the on-chain data did not confirm whether the owner signed intentionally, was phished, or had a compromised key.
According to PeckShield, there were 55 large-scale data breaches in which around $766.49 million worth of funds were stolen.
