Ethereum Pectra Upgrade is Largely Benefitting Crypto Theft Gangs
Wintermute found that 97% of delegated contracts using Ethereum’s EIP-7702 feature were tied to malicious activity, streamlining the transfer of ETH from wallets with leaked private keys.
Ethereum’s recently introduced smart wallet feature, EIP-7702, is under scrutiny after blockchain security researchers uncovered cybercriminals’ misuse of it. Following the Pectra upgrade, several wallet providers have begun integrating EIP-7702 features.
Analysts at Wintermute, a crypto trading firm, noted that attackers used 97% of EIP-7702 wallet delegations to deploy contracts designed to drain funds from unsuspecting users.
Hackers Use Ethereum’s EIP-7702 to Automate Mass Wallet Drainings
EIP-7702 temporarily allows externally owned accounts (EOAs) to operate as smart contract wallets. The upgrade enables features like transaction batching, spending limits, passkey integration, and wallet recovery—all without changing wallet addresses.
While these upgrades aim to enhance usability, malicious actors are leveraging the standard to speed up fund extractions.
Instead of moving ETH manually from each compromised wallet, attackers now authorize contracts that automatically forward any received ETH to their own addresses.
“No doubt attackers are one of the early adopters of new capabilities. 7702 was never meant to be a silver bullet and it does have great use cases,” Rahul Rumalla, Chief Product Officer at Safe, said.
Wintermute’s analysis shows that most of these wallet delegations point to identical codebases designed to “sweep” ETH from compromised wallets.
Ethereum’s EIP-7702 Transactions Delegate Approval. Source:
Dune
These sweepers automatically transfer any incoming funds to attacker-controlled addresses. Out of nearly 190,000 delegated contracts examined, more than 105,000 were linked to illicit activity.
Koffi, a senior data analyst at Base Network, explained that over a million wallets interacted with suspicious contracts last weekend.
He clarified that attackers didn’t use EIP-7702 to hack the wallets but to streamline theft from wallets with already exposed private keys
In case it wasn't clear: These wallets were not hacked using 7702. The hacker obtained the private keys without doing anything related to 7702.And, since they have the keys, they could transfer money out of these wallets by making regular transactions from each one.…
— Kofi (@0xKofi) May 31, 2025
The analyst furthered that one standout implementation includes a receive function that triggers ETH transfers the moment funds land in the wallet, eliminating the need for manual withdrawal.
Yu Xian, founder of blockchain security firm SlowMist, confirmed that the perpetrators are organized theft groups, not typical phishing operators. He noted that EIP-7702’s automation capabilities make it particularly attractive for large-scale exploits.
“The new mechanism EIP-7702 is used most by coin stealing groups (not phishing groups) to automatically transfer funds from wallet addresses with leaked private keys/mnemonics,” he stated.
Despite the scale of the operation, there are no confirmed profits so far.
Ethereum EIP 7702 Malicious Actors’ Address. Source:
Dune
A researcher at Wintermute noted that attackers have spent about 2.88 ETH authorizing over 79,000 addresses. One address alone executed nearly 52,000 authorizations, yet the target address has not received any funds.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
Avalanche Price Prediction November 2026: Can AVAX Break $9.03?
US CPI Exceeds Expectations Again, Waller's Warning Comes True! Wall Street Focuses on Whether December Rate Hike Will Be 25 or 50 Basis Points; "New Fed News Agency": Stop-and-Go Strategy Faces Test
The "New Federal Reserve Newsletter" pointed out that before the release of the CPI, Waller suggested the possibility of a 50-basis-point rate hike in December, and so far, no other Fed officials have publicly responded. In addition to a single 50-basis-point hike, the Fed may also choose to signal consecutive rate hikes in December and January. Wall Street generally believes that inflationary pressures remain stubborn, further strengthening the case for a rate hike in December, though a 50-basis-point increase is not a consensus. The market is concerned about whether the Fed will extend the tightening cycle.
CPI Deals a Blow to US Bonds! 2-Year Yield Surges Over 20 Basis Points Intraday, Gold and Silver Plunge
After the release of the CPI, traders began to expect a lower likelihood of a 50 basis point rate hike in December; this year’s Federal Reserve voting member Logan stated that a faster pace of rate hikes may be needed this winter, with at least two more 25 basis point hikes required before pausing. Subsequently, the rise in U.S. Treasury yields continued to widen, with the 10-year yield climbing back above 5.0% and rising more than 10 basis points intraday; spot gold once fell over 3%, while spot silver at one point dropped more than 4%.
Historical Data Reveals When XRP Could Peak This Cycle
Crypto prices
More
