Briefing
A sophisticated surge in Phishing-as-a-Service attacks is actively leveraging a technical flaw in Ethereum’s EIP-7702 upgrade to execute broad-spectrum wallet drains against individual users. This attack vector exploits the delegation mechanism intended for account abstraction, tricking users into signing transactions that grant malicious contracts temporary, comprehensive control over their assets. The primary consequence is a systemic failure of user-level security, with threat actors achieving a 72% month-over-month increase in stolen funds, quantified by over $12 million drained in August 2025 alone.
Context
The digital asset landscape has historically been vulnerable to social engineering, with phishing remaining a leading attack surface for non-protocol-level theft. Prior to this event, the prevailing risk factor was the compromise of private keys or blanket setApprovalForAll signatures; however, EIP-7702 introduced a new, complex primitive for Externally Owned Accounts (EOAs) to temporarily delegate smart contract functionality. This technical evolution, designed for enhanced user experience, inadvertently created a powerful, low-awareness attack vector that is now being weaponized at scale by syndicates like Eleven Drainer.
Analysis
The incident’s technical mechanics center on a malicious implementation of the EIP-7702 delegate function, which allows an EOA to temporarily behave as a smart contract. The attacker employs social engineering to present a deceptive website, prompting the victim to execute a seemingly innocuous signature request. This request, in reality, delegates the EOA’s authority to a malicious contract, effectively granting the attacker the ability to initiate arbitrary transactions and immediately drain all approved tokens. The success hinges on the victim’s inability to parse the complex, low-level details of the EIP-7702 signature request, which bypasses the standard token approval warning mechanisms.
Parameters
- Total Funds Drained → $12.0 Million+ (Total losses reported from this vector in August 2025).
- Victim Count → 15,000+ Wallets (Number of compromised wallets in the reporting period).
- Single Largest Loss → $3.08 Million (Amount stolen from one high-value “whale” account).
- Vulnerability Standard → EIP-7702 (Ethereum Improvement Proposal leveraged for the attack).
Outlook
Immediate mitigation requires users to exercise extreme vigilance with all wallet signature requests, treating any request that is not a simple token approval or transaction as a high-risk event. Protocols must integrate enhanced wallet interface security that provides human-readable, context-aware warnings for EIP-7702-style delegation calls. This incident establishes a new security best practice, demanding that wallet providers prioritize the clear, non-technical translation of complex signature types to neutralize the social engineering component of this systemic threat.
