Ethereum Wallet Drained via Malicious EIP-7702 Authorization

The incident occurred when the victim signed an authorization that enabled attacker-controlled code to execute directly through their wallet. By sponsoring a type-4 transaction, the attacker activated this delegation, allowing them to invoke the PodMining.claim() function to seize rewards and drain the remaining Ethereum balance. ExVul confirmed that the theft did not stem from bugs in the PodMining platform or TAPEETH tokens themselves, but rather from the dangerous delegation of account control.

EIP-7702, a feature of Ethereum’s account abstraction, permits externally owned accounts to execute smart contract code. While designed to improve user experience, the specification carries significant risks if a user authorizes malicious contracts. In this case, the delegation remained active at block 26,188,153, posing a persistent threat to any new assets deposited into the wallet. Security researchers emphasize that such authorizations do not expire automatically, requiring users to explicitly clear or replace the delegation to regain full control over their funds.