Ethereum’s latest protocol enhancement, EIP-7702, has ignited concern across the blockchain community as malicious actors exploit the upgrade’s delegation feature to target user wallets. Introduced as part of the Pectra upgrade earlier this year and championed by Ethereum co-founder Vitalik Buterin, EIP-7702 was meant to improve wallet functionality but now appears to have opened the door to sophisticated exploits.
From Innovation to Vulnerability
EIP-7702 was designed to allow standard Ethereum wallets to temporarily behave like smart contracts, granting them new powers for automation, transaction batching, and gas efficiency. However, this flexibility has become a double-edged sword.
Security analysts have reported a sharp rise in wallet-draining scripts following the upgrade, with multiple malicious contracts exploiting EIP-7702’s delegation feature. These exploits began surfacing around May 30, 2025, when market maker Wintermute flagged a pattern of abuse on-chain.
“CrimeEnjoyors”: The Rise of Wallet Draining Bots
The attackers’ primary toolset has been a type of malicious smart contract informally dubbed “CrimeEnjoyors.” These small, reusable code snippets automatically scan the blockchain for delegated wallets that lack proper safeguards. Once identified, they silently execute fraudulent token approvals, routing assets to wallets controlled by the attackers.
Though not all malicious contracts have successfully drained funds, the danger is real. On May 24, 2025, a user reportedly lost $150,000 worth of ETH in a phishing attack that leveraged a fraudulent contract exploiting EIP-7702 delegation.
According to Scam Sniffer, the malicious contracts often operate in stealth, making them difficult to detect until funds have already been moved. The attack pattern exploits compromised private keys and accelerates fund extraction using EIP-7702’s rapid delegation and approval features.
Expert Warnings and Security Recommendations
Blockchain security firm SlowMist and its founder Yu have issued warnings about the broader implications of EIP-7702 vulnerabilities. Yu noted that while the feature itself is not inherently flawed, it can drastically increase damage when paired with compromised keys or deceptive DApps.
SlowMist’s March 2025 analysis recommended a multi-pronged approach for users and developers:
- Verify smart contracts before delegating access
- Avoid untrusted DApps or unknown wallet popups
- Implement cautious signing practices to avoid accidental approvals
- Urge wallet providers to integrate clear visual warnings during delegation steps
These steps could drastically reduce user exposure and provide critical safeguards while Ethereum addresses the growing concerns.
Looking Ahead
The fallout from the EIP-7702 vulnerabilities adds another layer of urgency to Ethereum’s long-standing debate around user safety, innovation, and decentralization. While EIP-7702 aimed to usher in a new era of smart wallet capabilities, it has inadvertently exposed users to faster and more automated attacks.
As calls for better protection and smart contract auditing grow louder, Ethereum developers and wallet providers must act quickly to mitigate these risks before more users fall victim to cleverly engineered exploits.
