Ethereum user loses $22K in EIP-7702 wallet attack

cryptonews10-14

An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2675311260?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-14 16:07","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2675311260","market":"other","top_or_hot":-1,"title":"Ethereum user loses $22K in EIP-7702 wallet attack","media":"cryptonews","content":"<div>\n<p>An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to ...</p>\n\n<a href=\"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Ethereum user loses $22K in EIP-7702 wallet attack</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nEthereum user loses $22K in EIP-7702 wallet attack\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-14 16:07 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to ...</p>\n\n<a href=\"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BKCH","symbol_name":"AdvisorShares Sabretooth ETF","start_time":0,"source_url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/","article_id":"2675311260","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2675311260","pubTimestamp":1791965225,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to gain control of the account.Security firm ExVul reported that an Ethereum wallet lost 9.1231 ETH through malicious account delegation.The reported attack involved 1.69271471 TAPEETH tokens alongside Ethereum valued at approximately $22,770 at detection.A sponsored EIP-7702 transaction reportedly enabled attacker controlled code to execute through the victim’s wallet.The security firm warned that the malicious delegation remained active at Ethereum block 26,188,153 afterward.Blockchain security firm ExVul reported the incident on October 14, identifying an attacker-sponsored transaction that activated malicious code previously authorized by the wallet owner. The firm attributed the theft to an unsafe delegation, explaining that the attacker drained the wallet without exploiting the underlyi","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"BKCH":"AdvisorShares Sabretooth ETF","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","BITW":"Bitwise 10 Crypto Index ETF","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","ETHA":"以太坊ETF-iShares","09179":"嘉实以太币-U","03179":"嘉实以太币","ARKY":"ARK Active Autocallable Income ETF","YETH":"Roundhill Ether Covered Call Strategy ETF","LFGY":"YieldMax Crypto Industry and Tech Portfolio Option Income ETF","ETHW":"以太坊ETF-Bitwise","EZET":"以太坊ETF-Franklin","ETH":"低成本以太坊ETF-Grayscale","SBIT":"2倍做空比特币期货ETF-Proshares","CRPT":"First Trust SkyBridge Crypto Industry and Digital Economy ETF","ETHV":"以太坊ETF-VanEck","BITB":"比特币ETF-Bitwise","EETH":"以太币期货ETF-ProShares","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","ETHU":"2倍以太币期货ETF-Volatility Shares","09046":"华夏以太币-U","BETE":"等权重比特币&以太币期货ETF-ProShares","FETH":"以太币ETF-Fidelity","ETU":"T-Rex 2X Long Ether Daily Target ETF","STCE":"Schwab Crypto Thematic ETF","03046":"华夏以太币","03009":"博时以太币","NCIQ":"HASHDEX NASDAQ CRYPTO INDEX US ETF","ETHT":"ProShares Ultra Ether ETF","BTCW":"比特币ETF-Wisdom Tree","BETH":"比特币&以太币期货ETF-ProShares","ETTY":"Amplify Ethereum 3% Monthly Option Income Etf","QETH":"以太坊ETF-Invesco Galaxy","ETCO":"Grayscale Ethereum HIGH Income ETF","BEGS":"RAREVIEW 2X BULL CRYPTOCURRENCY & PRECIOUS METALS ETF","09009":"博时以太币-U","ETHI":"Defiance Leveraged Long Income Ethereum ETF","SETH":"1倍做空以太币期货ETF-Proshares","BITQ":"Bitwise Crypto Industry Innovators ETF","ETHE":"最大以太坊ETF-Grayscale","AETH":"以太坊策略ETF-Bitwise","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","BTF":"比特币&以太币期货ETF-CoinShares","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","GDLC":"Grayscale CoinDesk Crypto 5 ETF","ETHD":"ProShares UltraShort Ether ETF","CETH":"以太坊ETF-21Shares"},"translate_title":"以太币用户在EIP-7702钱包攻击中损失2.2万美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BAGY":0.6,"BEGS":1.5,"BTCL":0.6,"ETU":1.5,"BKCH":1.5,"ETHA":1.5,"ETHE":1.5,"ETHW":1.5,"ETHI":0.6,"09009":1.5,"BTF":1.5,"CETH":1.5,"ETQ":0.6,"STCE":1.5,"SBIT":0.6,"EZET":1.5,"BETE":1.5,"BITB":0.6,"ARKY":1.5,"09179":1.5,"BITW":1.5,"NCIQ":0.9,"AETH":1.5,"03046":0.9,"GDLC":1.5,"BITQ":1.5,"QETH":1.5,"YETH":1.5,"03009":0.9,"EETH":1.5,"ETTY":1.5,"ETH":1.5,"SETH":0.6,"CRPT":1.5,"ETHU":1.5,"ETHT":1.5,"LFGY":1.5,"BETH":1.5,"CBTJ":0.6,"ETHD":1.5,"09046":1.5,"ETCO":0.6,"QBF":0.6,"METHmain":1.5,"03179":0.9,"BTCW":0.6,"ETHV":1.5,"FETH":1.5},"content_text":"An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to gain control of the account.\n\n\nSummary\n\n\n\nSecurity firm ExVul reported that an Ethereum wallet lost 9.1231 ETH through malicious account delegation.\nThe reported attack involved 1.69271471 TAPEETH tokens alongside Ethereum valued at approximately $22,770 at detection.\nA sponsored EIP-7702 transaction reportedly enabled attacker controlled code to execute through the victim’s wallet.\nExVul attributed the theft to malicious wallet authorization, not a vulnerability in PodMining or TAPEETH.\nThe security firm warned that the malicious delegation remained active at Ethereum block 26,188,153 afterward.\n\n\n\nBlockchain security firm ExVul reported the incident on October 14, identifying an attacker-sponsored transaction that activated malicious code previously authorized by the wallet owner. The firm attributed the theft to an unsafe delegation, explaining that the attacker drained the wallet without exploiting the underlying DeFi protocol.\nThe reported incident involved the wallet linked to sven.eth and an attacker-controlled address beginning with 0x9208. According to ExVul’s investigation, the authorization allowed code installed through Ethereum’s EIP-7702 mechanism to operate with the wallet’s permissions.\nEthereum EIP-7702 attack drains ETH and TAPEETH\nThe reported theft involved 9.1231 ETH and 1.69271471 TAPEETH, with the ETH portion valued at approximately $22,770 when ExVul published its findings. The security firm did not provide a separate dollar valuation for the TAPEETH tokens.\nExVul identified the transaction hash as 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee, linking the activity to a sponsored type-4 Ethereum transaction. Such transactions support EIP-7702 authorizations, which allow ordinary wallet addresses to execute smart contract code.\nThe investigation attributed the attack to 0x9208097c007be15e28b20e94e66870a3f9f820bc. The victim’s wallet was identified as 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28, while the malicious delegation pointed to 0x0366b55f948a688888ca6e029ad0831f6ec260d1.\n\n🚨 ALERT — EIP-7702 Wallet Drain on Ethereumsven.eth was drained for 9.1231 ETH net (~$22.77K) plus 1.69271471 TAPEETH.No flash loan or AMM manipulation was involved: the attacker sponsored a type-4 transaction carrying the victim's valid EIP-7702 authorization, then swept…— ExVul (@exvulsec) October 14, 2026\n\nAccording to the security alert, the attacker submitted a transaction containing an EIP-7702 authorization signed by the victim. Once Ethereum processed that authorization, subsequent calls to the affected wallet executed the delegated contract’s instructions within the victim account.\nThe attacker-controlled code reportedly contained a fixed address authorized to operate the wallet. The controller then invoked the PodMining.claim() function, transferred the resulting TAPEETH rewards and withdrew the wallet’s ETH balance.\nExVul emphasized that “No flash loan or AMM manipulation was involved.” Its findings identified the account authorization as the entry point, with no evidence in the supplied analysis of an exploit involving liquidity pools or price manipulation.\nHow malicious wallet delegation enabled the theft\nEIP-7702 is part of Ethereum’s account abstraction development, allowing externally owned accounts to temporarily gain smart contract functionality through delegated code.\nUnder the official Ethereum specification, a user signs an authorization identifying the smart contract that will control the account’s execution behavior. Once submitted through a compatible transaction, Ethereum records the delegation and runs the designated code when the wallet receives relevant calls.\nThe feature supports legitimate applications, including sponsored transactions, transaction batching and more flexible wallet permissions. A user can authorize multiple actions through a single transaction or allow a third party to cover the network fee.\nHowever, the same mechanism carries security risks when an account delegates execution to malicious code. Ethereum’s EIP-7702 specification explains that poorly designed or malicious delegation contracts can grant an outside party extensive control over the account.\nIn this incident, the attacker reportedly paid the transaction fee and submitted the signed authorization. The wallet owner did not need to fund or broadcast the transaction that activated the malicious delegation.\nThe signature supplied authority for the wallet to execute the attacker’s code. Once activated, the code operated under the victim’s account context, allowing the controller address to initiate the reported asset transfers.\nExVul stated that the exploit “is not a TAPEETH / PodMining bug.” The conclusion distinguishes the authorization mechanism from a vulnerability in the token or the reward contract.\nThe firm did not establish how the attacker obtained the victim’s authorization. Its public findings do not identify a specific phishing website, malicious application or compromised signing interface.\nMalicious authorization could threaten future deposits\nAfter the reported theft, ExVul warned that the wallet’s malicious delegation remained active at Ethereum block 26,188,153.\nThe warning concerns a feature of EIP-7702: setting a delegation does not automatically remove it when the transaction finishes. The authorized contract can remain associated with the wallet until the account owner replaces or clears the delegation.\nEthereum’s official security guidance explains that a wallet owner retains control through the original private key, including the ability to reset delegation by authorizing the zero address. However, malicious delegated code may remain dangerous until the change is successfully processed.\nExVul warned users against transferring new assets into the affected address while the suspicious delegation remained active. Newly deposited funds could face the same exposure if the attacker’s code continued to control spending permissions.\nThe firm recommended clearing or replacing the authorization and moving remaining assets to a secure wallet. Such recovery actions require care because the affected address may execute malicious instructions while the delegation persists.\nThe warning was based on the delegation status observed at block 26,188,153. ExVul’s original alert did not establish whether the victim had subsequently removed the malicious code or recovered any assets.\nNo reimbursement arrangement, recovery transaction or law enforcement action was identified in the supplied investigation.\nEIP-7702 has faced earlier wallet security concerns\nThe latest reported attack follows previous warnings from blockchain security researchers about malicious account delegations.\nIn May 2025, crypto market maker Wintermute identified widespread use of EIP-7702 contracts designed to automatically drain funds from compromised Ethereum wallets.\nWintermute’s research found that more than 97% of observed EIP-7702 delegations at that stage pointed to contracts using identical code. Its analysis associated many of those delegations with automated sweepers that could transfer incoming ETH to attacker-controlled addresses.\nThe earlier security concerns surrounding Ethereum’s Pectra upgrade centered on attackers abusing wallet delegation features introduced through EIP-7702. Security researchers warned that malicious code could remain connected to accounts after victims completed the initial authorization.\nA separate incident involving World Liberty Financial tokens in September 2025 raised similar concerns. Blockchain investigator Yu Xian reported that attackers were using compromised wallet permissions and EIP-7702 delegation to target holders after token transfers became available.\nThe phishing attacks against WLFI token holders involved malicious delegation contracts that allowed attackers to execute unauthorized transactions. Investigators linked the activity to compromised wallet credentials and fraudulent authorizations.\nIn July 2026, another Ethereum phishing incident involving nearly $1 million demonstrated how dangerous wallet approvals can expose cryptocurrency holdings. That case involved malicious transaction permissions and was not established as the same exploit method reported against sven.eth.\nEthereum’s EIP-7702 specification identifies several safeguards for developers building delegation contracts, including replay protection, authenticated transaction parameters and secure initialization procedures.\nThe specification warns that poorly implemented delegation contracts may give malicious actors nearly complete control over the affected account. It recommends carefully verifying the permissions granted to delegated code, particularly when external parties can submit transactions on behalf of wallet owners.\nExVul’s October 14 alert identified the malicious contract, controller address and affected account, but did not disclose whether the victim had since replaced the authorization. The investigation recorded the suspicious delegation as active at block 26,188,153.\n\n\n\n\n\n                Read more:\n            \nSolana price falls 9% ahead of major October 21 upgrade","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"-1","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.52.0","shortVersion":"4.52.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2675311260","isCrawlerRequest":true}