Briefing
A new class of wallet drainers is leveraging the delegation features of modern transaction standards to compromise user funds, representing a significant evolution beyond the classic token approval phishing attacks. This vector tricks users into signing a single delegation transaction, which grants the attacker’s malicious contract broad execution rights to initiate subsequent batch transfers and drain multiple assets simultaneously. This architectural shift allows threat actors to bypass many current transaction simulation tools and has contributed to the broader drainer threat category, which accounted for over $494 million in losses during 2024.
Context
The prevailing security model relied on users checking token approve permissions, a vector widely understood by the ecosystem. However, this defense created a predictable attack surface where drainers were forced to repeatedly prompt users for high-value token approvals. The core vulnerability leveraged is the protocol’s inherent trust in a signed transaction’s intent , rather than its effect post-delegation.
Analysis
The attacker initiates the compromise through social engineering, typically a fake “wallet upgrade” or “security enhancement” dApp. Instead of a standard approve call, the victim signs a delegation transaction, effectively granting the attacker’s contract temporary or permanent execution authority over the wallet. This delegated contract then executes a batch of malicious transferFrom calls, siphoning all accessible ERC-20 tokens and NFTs without requiring any further user interaction. The success stems from the transaction being architecturally valid, masking the malicious delegation payload from basic wallet simulators.
Parameters
- Total Funds Stolen (2024) → $494 Million → Total estimated funds stolen by all wallet drainers in 2024, highlighting the scale of the threat category this new vector enhances.
- Attack Vector Evolution → Delegation Transaction → The new cryptographic signature type used to grant a malicious contract execution authority over a user’s wallet, bypassing traditional token approval checks.
- Primary Defense Failure → Transaction Simulation → The mechanism that fails to accurately interpret the long-term, multi-asset draining potential of a single delegation signature.
Outlook
Users must immediately treat any request for a “wallet upgrade” or “execution delegation” with maximum suspicion, revoking all non-essential token approvals and utilizing hardware wallets. The contagion risk is systemic, as this vector is protocol-agnostic and targets the fundamental transaction signing process common to all EVM-compatible chains. This incident will establish a new security standard mandating advanced, deep-state transaction simulation tools that can fully resolve the execution path of delegated functions before a signature is authorized.
Verdict
The weaponization of transaction delegation represents a critical, systemic failure in user-side security tooling, marking the definitive evolution of social engineering into an architectural threat.
