Attackers drove most of the early use of Ethereum's wallet upgrade feature — what that signature hands over

A peer-reviewed study released for USENIX Security '26 found that contracts linked to attackers were behind 2,322,548 of the 3,664,166 EIP-7702 authorizations it observed across seven chains through July 15, 2025, or about 63% of the transactions in its dataset. EIP-7702 is the Ethereum feature that lets an ordinary wallet address take on the abilities of a smart contract. The number describes how quickly attackers moved into a new feature, not how dangerous wallets are today.

Ethereum switched the feature on with the Pectra upgrade on May 7, 2025. A normal account can now set a pointer to deployed contract code: the address stays the same, the original private key keeps control, and calls to the account can run the code it points at. That is how a plain wallet gains smart-account conveniences such as batching several actions into one transaction or letting someone else pay the gas, without moving to a new address. The trade-off is that the code being pointed at can act with the account's authority, which includes approving tokens, transferring them and calling applications.

That is also the opening. An attacker can prepare the authorization fields off-chain and ask a victim to sign them, while the wallet may compress the whole thing into a friendly account-upgrade prompt that hides which contract is actually receiving the authority. The protocol only verifies that the account owner signed; judging whether the chosen code deserves control is left to the wallet. Working through more than 22.8 billion historical transactions on Ethereum, BNB Smart Chain, Polygon, Optimism, Arbitrum, Base and Gnosis, the researchers identified 924 malicious contracts, classifying 793 as aimed at ordinary accounts, 124 at contract accounts and seven as composite attacks, and measured about $2.36 million in realized losses.

The knock-on effects reach code that was written before the feature existed. Some older contracts checked whether the caller was a plain address as a defense against flash loans, an assumption EIP-7702 breaks; the study found 967 active contracts still relying on that check, with roughly $10.1 million in assets exposed by it. The researchers also saw attackers repoint accounts back to harmless code after an attack, which makes monitoring that only looks at the current state unreliable, and found 500 delegation targets pointing at addresses with no code deployed yet, which can be filled in later.

The study's own limits matter. It counted transactions rather than distinct wallets, malicious contracts were reused heavily so transaction counts climb much faster than the number of affected users, and some of the attacker activity looked like practice or proof-of-concept work during an exploratory early phase. The current rate of abuse in 2026 was outside its scope, and the 924 contracts are the set the researchers detected and verified by hand, not the whole universe.

The practical read for a beginner is to treat any request to upgrade or delegate your account as installing a new controller over it, not as a settings tweak. Guidance published on ethereum.org after the study asks wallets to whitelist delegation contracts, show the target address prominently, avoid arbitrary delegation on hardware wallets and stick to audited implementations. On your side: if a page asks for a signature you cannot read, and especially if the reason offered is an airdrop, a claim or a support fix, do not sign it. Genuine upgrades are offered by your wallet itself, not by a link someone sent you.