ExVul flags EIP-7702 malicious wallet drain contract on Ethereum
Security firm ExVul says a malicious EIP-7702 delegation let an attacker drain 9.1231 ETH (about $22,770) and TAPEETH tokens from an Ethereum wallet; the delegation stayed active afterwards.
- First reported
- Reports
- 1
Source: crypto.news · published
What happened
crypto.news reported on October 14, 2026 that blockchain security firm ExVul found an Ethereum wallet had lost 9.1231 ETH (about $22,770 at detection) and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorisation.
ExVul attributed the theft to unsafe wallet delegation, not a bug in PodMining or TAPEETH, and said no flash loan or market manipulation was involved. It named attacker address 0x9208097c007be15e28b20e94e66870a3f9f820bc, delegation contract 0x0366b55f948a688888ca6e029ad0831f6ec260d1 and transaction 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee. It did not establish how the attacker obtained the victim's signature.
How the scam works
EIP-7702 lets an ordinary Ethereum wallet run smart-contract code that the owner authorises with a signature. It has legitimate uses, such as batching and sponsored fees, but a signature pointing to malicious code gives an outside party control.
Here, the attacker paid the fee and submitted a type-4 transaction carrying an authorisation the victim had previously signed. The delegated code had a fixed controller address, which called PodMining.claim(), transferred the TAPEETH rewards and withdrew the ETH.
A delegation does not expire when the transaction ends. ExVul warned it was still active at block 26,188,153, so any new deposits to that address would be exposed until the owner clears it.
Source
crypto.news, "Ethereum user loses $22K in EIP-7702 wallet attack" (October 14, 2026), reporting ExVul's findings.
Red flags
- Requests to sign an "authorization" or upgrade your wallet to a smart account from a site or app you don't fully trust.
- Signature prompts that don't clearly show what contract you are delegating to.
- Funds leaving your wallet even though you never sent a transaction.
If you were targeted
- 1Never sign EIP-7702 or account-upgrade authorisations from unfamiliar sites.
- 2If your wallet has an unknown delegation, do not deposit more funds; clear it (Ethereum's guidance is to re-authorise to the zero address) and move remaining assets to a new wallet.
- 3Report the theft with transaction hashes to the FBI at ic3.gov or your national cybercrime agency.