eip-7702

According to The Defiant, developer nicolashw submitted a draft Ethereum Improvement Proposal on October 30, which aims to allow external accounts (EOA) to permanently disable the delegation feature of EIP-7702 while retaining the original address, regular transfer, and contract call capabilities.This operation is irreversible and, unlike simply clearing the current delegation, can prevent the account from authorizing smart contract code to run on its behalf in the future. However, it cannot prevent the transfer of funds after a private key leak, nor will it revoke existing token authorizations, and it may also affect account recovery and asset access that rely on the delegation feature.Currently, the draft has not been merged and has not received an official EIP number; if adopted later, it will still need to be activated through an Ethereum network upgrade.

The founder of Slow Fog, Yu Xian, tweeted that the Binance hacker chose the EIP-7702 mechanism on Ethereum solely for the convenience of the cleanup work, which is to bulk steal tokens from Binance-related hot wallets.Yu Xian stated that, from an on-chain perspective, the hacker's operations were relatively crude, and they conducted several hours of rehearsal preparation before the actual theft. He emphasized that there is nothing wrong with the EIP-7702 mechanism itself; even without this protocol mechanism, there are other ways to achieve similar operations.

According to on-chain data, one of the stolen hot wallets of Binance, Binance 14, revoked the EIP-7702 authorization on October 30 at 8:10 AM Beijing time. This incident involving Binance pertains to the EIP-7702 authorization mechanism, where after signing such authorization, the wallet will be taken over by a specific program until the authorization is revoked.This attack exploited that mechanism. The attacker managed to have Binance's hot wallet sign an EIP-7702 authorization, delegating control of the wallet to a malicious cleanup contract pre-deployed by the attacker. Once the authorization took effect, the malicious contract gained permission to operate the wallet, allowing it to automatically transfer assets in bulk without requiring additional signatures from the wallet owner.

Cobo co-founder Shen Yu released a video reviewing the suspected theft incident at Binance from an on-chain perspective. Shen Yu stated that the attacker broadcast a transaction containing 50 authorization requests at 4:20 AM on October 30, and about 3 minutes later began to transfer assets in bulk, involving multiple chains such as Ethereum and Tron. Based on the prices at that time, the total amount of transferred assets was estimated to be around 5.8 billion USD.The attacker utilized the EIP-7702 authorization mechanism to carry out the asset transfer, having previously prepared a transfer list covering 64 types of tokens and conducted two rehearsals using a test wallet, with the last rehearsal occurring about 3.5 hours before the official attack. During the attack process, the attacker also exchanged part of the USDT and other freezeable assets for ETH to evade the issuer's freezing measures.Shen Yu disclosed that as of now, Tether has frozen 1.38 billion USDT, Circle has frozen 823 million USDC, Ripple has frozen 40.54 million RLUSD and other tokens. Of the approximately 3.75 billion USD in assets transferred on the Ethereum chain, about 2.4 billion USD has already been frozen; of the approximately 630 million USD in assets transferred on the Tron chain, about 380 million USD has been frozen. Shen Yu believes the core issue may lie in the signing process, and no contract vulnerabilities have been found so far. Whether it is a private key leak or a signing system exploitation remains to be further confirmed by Binance, and he reminded all trading platforms to investigate the risks of signing unexpected authorizations. The estimated 5.8 billion USD is the total amount of multi-chain transferred assets based on the prices at that time, not the confirmed final stolen loss.

Regarding the incident of Binance allegedly being hacked, there are opinions suggesting that hackers may have exploited the Ethereum EIP-7702 mechanism to control wallets and transfer funds. User 0xVEER stated that developer 0xjustadev had warned about such a situation during the EIP-7702 discussion approximately two years ago. Currently, it has not been officially confirmed by Binance whether this incident is indeed related to EIP-7702; the aforementioned content is merely a community opinion.The attached screenshot shows that in October 2024, a developer pointed out in the Ethereum community forum discussion thread on EIP-7702 (Set EOA account code) that phishing techniques at that time mainly revolved around EIP-712 signatures, which were relatively readable and easier to simulate. The proposal could potentially allow attackers to transfer all valuable assets, including native tokens, through signatures that are less readable and harder to simulate. The developer also expressed concern that wallets might adopt highly centralized contract signature whitelists as a result, constituting a regression in security and decentralization.

The blockchain security platform Phalcon stated that approximately 6 hours ago, around 3.55 million dollars of unclaimed cross-chain funds were claimed and transferred. Phalcon raised the question: Was the related transaction initiated by the fund owner, or did the attacker obtain valid EIP-7702 authorization?On-chain information shows that the claim was submitted by address 0x24a9, with funds coming from Tornado Cash and executed through EIP-7702 delegation on an external account. The two transaction amounts were 1.33 million dollars and 2.22 million dollars, with on-chain data confirming the validity of the related authorization.A few days ago, on-chain researcher stuckfunds.eth repeatedly sent messages to address 0x4943, informing the owner that the related funds were still claimable. Currently, on-chain data cannot confirm whether the owner intentionally signed, was induced to sign, or if the private key has been leaked.

According to Specter monitoring, a long-inactive PancakeSwap liquidity provider (LP) lost approximately $2.96 million due to signing a malicious EIP-7702 authorization.It is reported that the attacker removed about $1.48 million in BSC-USD and $1.48 million in BUSD liquidity provided by the victim and exchanged BUSD for ETH. Currently, the attacker has deposited approximately $1.46 million in funds to Tornado Cash, while the remaining approximately $1.48 million in USDT is still held in the attacker's address.

According to market news, attackers exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause is that the reserve pool administrator EOA delegated the code to the BatchExecutor contract via EIP-7702, and this contract set the permissionless BatchCall contract as the authorized caller.Since the BatchCall.batch() function did not have any permission checks set, any external caller could invoke it, ultimately leading to the depletion of the reserve pool assets.

Slow Mist posted on platform X that MistEye detected potential suspicious activities related to Fusion. The root cause is a vulnerability in the underlying contract commissioned by an EOA account controlled by the project team through EIP-7702, which allows arbitrary external calls, enabling attackers to create and configure malicious circuit breaker contracts for PlasmaVault, thereby extracting funds from the contract.

ChainCatcher message, the GoPlus browser security plugin now fully supports EIP-7702 detection features, providing stronger security protection for Web3 users.This update includes core features such as real-time risk alerts, advanced threat detection, and protection against malicious contracts, capable of instantly identifying and intercepting various attacks based on the EIP-7702 protocol during transactions. As one of the first platforms to focus on the security threats of this protocol, GoPlus recommends users update their extensions in a timely manner to arm themselves with the latest security tools and ensure asset safety.

ChainCatcher news, according to Protos, Wintermute research shows that nearly half of the Ethereum Improvement Proposal 7702 (EIP-7702) user authorizations are associated with criminal activities such as phishing and fund theft.The report states that since May 7 of this year, users have activated this feature 1,580,930 times, with the Wintermute team marking 768,275 instances (48%) as crime-related. This sharply contrasts with Vitalik Buterin's earlier claim that this temporary smart contract feature would provide users with "superpowers" and "guardrails."EIP-7702 allows users to temporarily convert their signed accounts into smart contract wallets during transactions, aimed at enhancing user experience and security.

ChainCatcher news, Slow Mist's Yu Xian stated that a user was phished after participating in the WLFI private placement due to a private key leak, resulting in the complete theft of assets from their MetaMask wallet.The attack is suspected to exploit the EIP-7702 mechanism, where once the user injects gas or attempts to withdraw WLFI, their assets will be automatically transferred away. It is recommended that if rescue is needed, users can try to use Flashbots for a block race operation, but the threshold is relatively high. Users are reminded to be highly vigilant about the secondary risks brought by private key leaks.

ChainCatcher news, according to on-chain security analyst Scam Sniffer (@realScamSniffer), on August 26, a user lost $235,977 worth of crypto assets after signing a malicious EIP-7702 batch transaction.

ChainCatcher message, Slow Mist founder Yu Xian forwarded a security warning issued by Scam Sniffer, stating that today another user lost approximately $1.54 million due to signing EIP-7702 phishing batch transactions, involving multiple tokens staked on Ethereum, including ETH and BTC.This phishing method utilizes EIP-7702 to delegate the user's EOA address authorization to MetaMask: EIP-7702 Delegator, and completes subsequent token transfer operations through its contract calls. This phishing technique has been industrially practiced by mainstream phishing gangs, and if users are inadvertently induced to trade, they will lose all account assets.Yu Xian reminds users to verify the authenticity of websites and links before confirming transactions to prevent fraud.

ChainCatcher news, according to Scam Sniffer monitoring, some users have lost approximately $1.54 million due to signing EIP-7702 phishing batch transactions. The victims signed EIP-7702 phishing batch transactions, which included multiple token transfers and NFT approval operations.

ChainCatcher news, according to official information, GoPlus Security has issued a security alert. Recently, new phishing attacks targeting EIP-7702 smart accounts have re-emerged on the Ethereum mainnet, BNB Chain, and Base chain. In just 3 days since its launch, thousands of addresses have fallen victim, with losses exceeding $10,000 in crypto assets. The attackers use one address for authorization phishing; once the user authorizes, that address can automatically transfer the BNB or other tokens that the user subsequently deposits.The GoPlus security team reminds users: do not transfer or authorize to unknown addresses. The current 7702 scam is leveraging historically leaked private key addresses for large-scale phishing attacks, so please remain vigilant.

ChainCatcher news, according to TheBlock, Wintermute recently issued a warning that the Ethereum Pectra upgrade may expose users to automated attacks. The EIP-7702 feature (account abstraction improvement) in the Ethereum Pectra upgrade is being maliciously exploited, with over 80% of authorizations being used for automated attacks. Blockchain security company Scam Sniffer recently monitored a user who lost nearly $150,000 due to a phishing attack, where the attacker deployed a copy-paste contract named "CrimeEnjoyor" that can automatically drain wallets with leaked private keys. EIP-7702, proposed by Ethereum founder Vitalik Buterin, aims to enhance user experience by temporarily granting wallets smart contract functionality, including batch processing multiple transactions, sponsoring gas fees, using biometric/social verification, and setting single transaction limits.According to Wintermute's Dune dashboard, the vast majority of EIP-7702 authorizations flow to malicious contracts with similar functions. Security expert Taylor Monahan pointed out that EIP-7702 makes draining addresses "cheaper and easier." Wintermute commented, "It's both absurd and cruel that the same copied bytecode occupies most of the EIP-7702 authorizations."BlockBeats previously reported that SlowMist founder Yu Xian stated that the biggest users of the new Ethereum mechanism EIP-7702 are theft gangs (rather than phishing organizations). EIP-7702 allows for the automatic transfer of funds from wallets with leaked private keys or mnemonic phrases through authorizations, with over 97% of EIP-7702 delegations pointing to theft contracts.