An Ethereum wallet linked to the ENS name sven.eth has reportedly lost 9.1231 ETH along with 1.69271471 TAPEETH tokens after an attacker used a malicious authorization under Ethereum Improvement Proposal 7702 (EIP-7702) to gain control of the account.
According to a circulating security alert from ExVul, which estimated the loss at $22.7K, the attacker did not exploit a decentralized exchange or manipulate liquidity pools. Instead, the wallet owner had signed an authorization that allowed the account to execute code deployed by the attacker. The attacker subsequently included that authorization in a sponsored transaction and transferred the assets out of the wallet.
The compromised wallet, identified as 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28, allegedly delegated execution authority to a malicious contract at 0x0366b55f948a688888ca6e029ad0831f6ec260d1.
The alert attributes the attack to wallet 0x9208097c007be15e28b20e94e66870a3f9f820bc, which reportedly initiated the transaction and executed the fund transfers.
The reported losses and transaction sequence have not yet been independently confirmed against the full transaction record. The alert’s Etherscan link contains a shortened transaction hash, preventing a conclusive transaction-level verification.
How the Attacker Used EIP-7702 to Drain the Wallet
The incident reportedly involved an Ethereum type-4 transaction, a transaction format introduced through EIP-7702 as part of the network’s Pectra upgrade in May 2025.
EIP-7702 allows externally owned accounts (EOAs), which are conventional wallets controlled by private keys, to execute smart contract code without changing their wallet addresses. The feature supports operations such as batching transactions and allowing a third party to sponsor gas fees.
Under the official EIP-7702 specification, a wallet owner can authorize an existing smart contract to execute code in the wallet’s context. Once the authorization is processed, the account uses the delegated contract’s logic until the delegation is replaced or cleared.
In the reported attack, sven.eth had signed an authorization pointing to code controlled by the attacker. The attacker then sponsored a transaction containing that authorization, meaning the victim did not need to initiate or pay gas for the transaction that activated the delegation.
Once the delegation took effect, the malicious code reportedly gave a hard-coded controller address permission to execute operations from the victim’s wallet.
The attacker allegedly used that control to call PodMining.claim(), collect newly minted TAPEETH rewards, transfer those rewards and withdraw the account’s ETH balance in a single transaction.
The alert specifically states that the incident was not caused by a vulnerability in the TAPEETH token or the PodMining protocol. The reported entry point was the authorization that delegated the wallet’s execution rights to malicious code.
Malicious Delegation Could Leave Wallet Exposed
The security alert states that the malicious delegation remained active at Ethereum block 26,188,153, even after the reported theft. That creates a continuing risk because EIP-7702 delegation is not automatically removed when the transaction that established it finishes. New funds deposited into an account with malicious delegated code could become accessible to the attacker.
Ethereum’s official guidance on EIP-7702 warns that users who unknowingly delegate their accounts to malicious contracts can lose control over their assets. The original wallet’s private key retains the ability to authorize a replacement or reset of the delegation, provided it remains secure.
For the affected sven.eth wallet, the alert recommends avoiding new deposits, clearing or replacing the malicious delegation and moving any remaining assets to a newly secured wallet.
The delegation status cited in the alert refers specifically to block 26,188,153. Its status as of publication has not been independently verified.
EIP-7702 Wallet Attacks Have Targeted Ethereum Users Before
The reported sven.eth incident follows earlier cases in which attackers abused Ethereum’s wallet delegation functionality.
In September 2025, hackers used EIP-7702 to drain World Liberty Financial (WLFI) token wallets. SlowMist founder Yu Xian said attackers were using malicious delegations to seize assets from compromised wallets when tokens became available.
Earlier, blockchain trading firm Wintermute identified widespread malicious delegation activity following Ethereum’s Pectra upgrade. According to The Crypto Times’ coverage of Wintermute’s findings, researchers found that more than 97% of the delegations in their analyzed dataset were associated with malicious sweeper contracts. That figure described the dataset studied, rather than all EIP-7702 activity.
The latest alert describes a similar account-control risk, although the reported method differs from attacks involving leaked private keys or existing token allowances.
In this case, the attacker allegedly relied on a valid authorization directing the victim’s wallet to execute malicious code. The origin of that signed authorization, including whether it was obtained through phishing or another method, remains unknown.
Ethereum users can inspect their account’s delegation status and review authorizations before signing. Removing token allowances alone does not necessarily eliminate a malicious EIP-7702 delegation, because delegated code can carry broader account-level authority.
Also Read: SlowMist Flags BitBay and EtherVista Hacks as Attackers Drain $32,600 From DeFi Vault & Pool
