Over the past three months, more than 3.6 million transactions have leveraged EIP-7702’s delegation mechanism. 63% of them were malicious. That’s not a marginal bug. That’s a systemic failure in the security model of Ethereum’s most ambitious upgrade.
To understand the weight of this finding, we must step back to May 2025, when the Pectra upgrade activated EIP-7702 on mainnet. The proposal was celebrated as a paradigm shift: it allowed externally owned accounts (EOAs) to temporarily acquire smart contract capabilities without changing their base address. No more migrating funds to a new wallet. No more splitting identity across contracts. The promise was elegant, even poetic. But the execution, as we now see, was fragile.
This is not a theoretical vulnerability. The research, presented at USENIX 2026 and based on an analysis of 22.8 billion historical transactions, reveals a concrete attack surface. The core issue lies in the delegation mechanism itself. When an EOA signs a delegation, it authorizes a piece of code to act on its behalf. That code can be replaced at any time, through a new signature. The system assumes that users will verify the code before signing. But verification is a luxury most users don’t afford themselves. The result? A wave of malicious delegations, often disguised as benign “re-delegations,” that siphon funds or approve malicious transfers.
The numbers are stark. The researchers identified 242 distinct malicious contracts deployed specifically for EIP-7702 attacks. These contracts have caused approximately $2.36 million in direct losses, with an additional $10.14 million in assets currently exposed to similar risks. But the damage goes beyond monetary loss. The upgrade has broken fundamental assumptions in Ethereum’s security model. The simple check msg.sender == tx.origin, once a reliable guard against phishing, is now meaningless. Any contract that relied on this check is vulnerable.
Based on my experience auditing smart contracts during the 2017 ICO frenzy, I find this breakdown of the security model particularly alarming. Back then, I spent weeks analyzing Gnosis’s prediction market and identified a fatal flaw in its oracle dependency. That was a single protocol. This is an entire upgrade layer. The difference is scale. The difference is systemic trust.
Let’s talk about the attack vectors. The researchers uncovered a pattern of “re-delegation” attacks. A user signs a delegation to a seemingly benign contract, perhaps a simple script for streaming payments. The contract then changes its own code—through a mechanism called CREATE2, which allows contract deployment to predetermined addresses—to become malicious. The user’s wallet still shows the original contract address, which appears trustworthy. But the actual code has been swapped. The wallet displays “Active” status on Etherscan, hiding the corruption. This is not a vulnerability in the wallet. It is a vulnerability in the trust model of EIP-7702.
Trust no one. Verify everything. This signature, which I adopted during the dark days of DeFi Summer, applies here more than ever. But the problem is that the current verification tools are inadequate. The research found over 500 contracts deployed via CREATE2 that are still “undeployed” in the sense that they have not been analyzed, but their code is already set to execute malicious actions upon activation. These are time bombs.
The attack surface is not limited to direct financial theft. The researchers also found that the malicious delegation model can be used for “identity theft by proxy.” An attacker can delegate a legitimate EOA’s address to a malicious contract, then use that contract to interact with DeFi protocols on behalf of the victim. The victim’s address remains unchanged, so the protocol sees the same identity. But the actions are controlled by the attacker. This is a direct violation of the principle of “non-repudiation” in blockchain transactions.
Now, let’s confront the contrarian angle. Many in the community argue that EIP-7702 is a necessary evolution, and that the security issues are merely growing pains. They point to the fact that the upgrade has seen high adoption, with over 3.6 million transactions in three months, and argue that the malicious percentage is inflated by automated bots. But this argument misses the point. The problem is not the technology itself; it is the hurry. The EIP was rushed to mainnet without sufficient safeguards. The wallets were not updated to show the actual delegated code. The verification tools were not built. The community was not educated. The result is that the adoption curve is being driven by attackers, not by builders.
Noise is cheap. Signal is rare. The signal here is clear: the security model of EIP-7702 is incomplete. It solves the problem of address stability but introduces a new problem of code trust. The solution is not to abandon the upgrade, but to build the missing infrastructure. Wallets must show the actual code of the delegated contract, not just the contract address. Block explorers must flag re-delegation events. Protocols must update their security checks to account for the new attack surface. The research provides a roadmap for this, but the implementation will take time.
The 2022 bear market taught me a hard lesson about the gap between vision and reality. I spent that winter in solitude, reading classical political philosophy, trying to understand why blockchain’s promise of decentralization often fails in practice. The answer, I realized, is that trust is not a technical problem. It is a human one. EIP-7702 is a technical solution to the problem of user migration. But it creates a new trust problem that is more complex than the original. The user must now trust the code they delegate to, and the wallet must verify that trust. This is a harder problem than simply moving assets.
Summer fades. Builders remain. The builders who will survive this crisis are not the ones who chase the next hype. They are the ones who audit the code, who build the verification tools, who educate the users. The EIP-7702 security crisis is a wake-up call for the entire Ethereum ecosystem. It shows that account abstraction, while necessary, is not a panacea. It is a complex trade-off between convenience and security. The future of Ethereum depends on how we manage this trade-off.
Looking forward, I see three possible outcomes. The first is a fragmented response, where each wallet and protocol implements its own security measures, leading to inconsistency and confusion. The second is a coordinated effort to build a standard set of verification tools, similar to the ERC-4337 standard for user operations. The third is a regulatory response, where authorities mandate code audits and white-listing for delegated contracts, which could stifle innovation but improve safety. The best outcome is the second, but it requires leadership from the Ethereum Foundation and the major wallet providers.
Will we build a foundation of trust, or will we let the code run wild? The answer to that question will define the next decade of Ethereum.