7702

According to The Defiant, developer nicolashw submitted a draft Ethereum Improvement Proposal on October 30, which aims to allow external accounts (EOA) to permanently disable the delegation feature of EIP-7702 while retaining the original address, regular transfer, and contract call capabilities.This operation is irreversible and, unlike simply clearing the current delegation, can prevent the account from authorizing smart contract code to run on its behalf in the future. However, it cannot prevent the transfer of funds after a private key leak, nor will it revoke existing token authorizations, and it may also affect account recovery and asset access that rely on the delegation feature.Currently, the draft has not been merged and has not received an official EIP number; if adopted later, it will still need to be activated through an Ethereum network upgrade.

The founder of Slow Fog, Yu Xian, tweeted that the Binance hacker chose the EIP-7702 mechanism on Ethereum solely for the convenience of the cleanup work, which is to bulk steal tokens from Binance-related hot wallets.Yu Xian stated that, from an on-chain perspective, the hacker's operations were relatively crude, and they conducted several hours of rehearsal preparation before the actual theft. He emphasized that there is nothing wrong with the EIP-7702 mechanism itself; even without this protocol mechanism, there are other ways to achieve similar operations.

According to on-chain data, one of the stolen hot wallets of Binance, Binance 14, revoked the EIP-7702 authorization on October 30 at 8:10 AM Beijing time. This incident involving Binance pertains to the EIP-7702 authorization mechanism, where after signing such authorization, the wallet will be taken over by a specific program until the authorization is revoked.This attack exploited that mechanism. The attacker managed to have Binance's hot wallet sign an EIP-7702 authorization, delegating control of the wallet to a malicious cleanup contract pre-deployed by the attacker. Once the authorization took effect, the malicious contract gained permission to operate the wallet, allowing it to automatically transfer assets in bulk without requiring additional signatures from the wallet owner.

Regarding the incident of Binance allegedly being hacked, there are opinions suggesting that hackers may have exploited the Ethereum EIP-7702 mechanism to control wallets and transfer funds. User 0xVEER stated that developer 0xjustadev had warned about such a situation during the EIP-7702 discussion approximately two years ago. Currently, it has not been officially confirmed by Binance whether this incident is indeed related to EIP-7702; the aforementioned content is merely a community opinion.The attached screenshot shows that in October 2024, a developer pointed out in the Ethereum community forum discussion thread on EIP-7702 (Set EOA account code) that phishing techniques at that time mainly revolved around EIP-712 signatures, which were relatively readable and easier to simulate. The proposal could potentially allow attackers to transfer all valuable assets, including native tokens, through signatures that are less readable and harder to simulate. The developer also expressed concern that wallets might adopt highly centralized contract signature whitelists as a result, constituting a regression in security and decentralization.

Cobo co-founder Shen Yu posted on the X platform, stating that the 7702 delegation of Binance 14's hot wallet has not been revoked for over 2 hours.Shen Yu mentioned that a transfer of 2961 ETH to Binance 14 has been in a pending state due to low gas fees. Once the transaction is on-chain and the base fee drops below 4.4 gwei, the attacker may transfer approximately 2961 ETH again.

According to Specter monitoring, a long-inactive PancakeSwap liquidity provider (LP) lost approximately $2.96 million due to signing a malicious EIP-7702 authorization.It is reported that the attacker removed about $1.48 million in BSC-USD and $1.48 million in BUSD liquidity provided by the victim and exchanged BUSD for ETH. Currently, the attacker has deposited approximately $1.46 million in funds to Tornado Cash, while the remaining approximately $1.48 million in USDT is still held in the attacker's address.

According to market news, attackers exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause is that the reserve pool administrator EOA delegated the code to the BatchExecutor contract via EIP-7702, and this contract set the permissionless BatchCall contract as the authorized caller.Since the BatchCall.batch() function did not have any permission checks set, any external caller could invoke it, ultimately leading to the depletion of the reserve pool assets.

Slow Mist posted on platform X that MistEye detected potential suspicious activities related to Fusion. The root cause is a vulnerability in the underlying contract commissioned by an EOA account controlled by the project team through EIP-7702, which allows arbitrary external calls, enabling attackers to create and configure malicious circuit breaker contracts for PlasmaVault, thereby extracting funds from the contract.

ChainCatcher message, the GoPlus browser security plugin now fully supports EIP-7702 detection features, providing stronger security protection for Web3 users.This update includes core features such as real-time risk alerts, advanced threat detection, and protection against malicious contracts, capable of instantly identifying and intercepting various attacks based on the EIP-7702 protocol during transactions. As one of the first platforms to focus on the security threats of this protocol, GoPlus recommends users update their extensions in a timely manner to arm themselves with the latest security tools and ensure asset safety.

ChainCatcher news, according to Protos, Wintermute research shows that nearly half of the Ethereum Improvement Proposal 7702 (EIP-7702) user authorizations are associated with criminal activities such as phishing and fund theft.The report states that since May 7 of this year, users have activated this feature 1,580,930 times, with the Wintermute team marking 768,275 instances (48%) as crime-related. This sharply contrasts with Vitalik Buterin's earlier claim that this temporary smart contract feature would provide users with "superpowers" and "guardrails."EIP-7702 allows users to temporarily convert their signed accounts into smart contract wallets during transactions, aimed at enhancing user experience and security.

ChainCatcher news, Slow Mist's Yu Xian stated that a user was phished after participating in the WLFI private placement due to a private key leak, resulting in the complete theft of assets from their MetaMask wallet.The attack is suspected to exploit the EIP-7702 mechanism, where once the user injects gas or attempts to withdraw WLFI, their assets will be automatically transferred away. It is recommended that if rescue is needed, users can try to use Flashbots for a block race operation, but the threshold is relatively high. Users are reminded to be highly vigilant about the secondary risks brought by private key leaks.

ChainCatcher news, according to on-chain security analyst Scam Sniffer (@realScamSniffer), on August 26, a user lost $235,977 worth of crypto assets after signing a malicious EIP-7702 batch transaction.

ChainCatcher message, Slow Mist founder Yu Xian forwarded a security warning issued by Scam Sniffer, stating that today another user lost approximately $1.54 million due to signing EIP-7702 phishing batch transactions, involving multiple tokens staked on Ethereum, including ETH and BTC.This phishing method utilizes EIP-7702 to delegate the user's EOA address authorization to MetaMask: EIP-7702 Delegator, and completes subsequent token transfer operations through its contract calls. This phishing technique has been industrially practiced by mainstream phishing gangs, and if users are inadvertently induced to trade, they will lose all account assets.Yu Xian reminds users to verify the authenticity of websites and links before confirming transactions to prevent fraud.

ChainCatcher news, according to Scam Sniffer monitoring, some users have lost approximately $1.54 million due to signing EIP-7702 phishing batch transactions. The victims signed EIP-7702 phishing batch transactions, which included multiple token transfers and NFT approval operations.

ChainCatcher news, according to official information, GoPlus Security has issued a security alert. Recently, new phishing attacks targeting EIP-7702 smart accounts have re-emerged on the Ethereum mainnet, BNB Chain, and Base chain. In just 3 days since its launch, thousands of addresses have fallen victim, with losses exceeding $10,000 in crypto assets. The attackers use one address for authorization phishing; once the user authorizes, that address can automatically transfer the BNB or other tokens that the user subsequently deposits.The GoPlus security team reminds users: do not transfer or authorize to unknown addresses. The current 7702 scam is leveraging historically leaked private key addresses for large-scale phishing attacks, so please remain vigilant.

ChainCatcher news, according to TheBlock, Wintermute recently issued a warning that the Ethereum Pectra upgrade may expose users to automated attacks. The EIP-7702 feature (account abstraction improvement) in the Ethereum Pectra upgrade is being maliciously exploited, with over 80% of authorizations being used for automated attacks. Blockchain security company Scam Sniffer recently monitored a user who lost nearly $150,000 due to a phishing attack, where the attacker deployed a copy-paste contract named "CrimeEnjoyor" that can automatically drain wallets with leaked private keys. EIP-7702, proposed by Ethereum founder Vitalik Buterin, aims to enhance user experience by temporarily granting wallets smart contract functionality, including batch processing multiple transactions, sponsoring gas fees, using biometric/social verification, and setting single transaction limits.According to Wintermute's Dune dashboard, the vast majority of EIP-7702 authorizations flow to malicious contracts with similar functions. Security expert Taylor Monahan pointed out that EIP-7702 makes draining addresses "cheaper and easier." Wintermute commented, "It's both absurd and cruel that the same copied bytecode occupies most of the EIP-7702 authorizations."BlockBeats previously reported that SlowMist founder Yu Xian stated that the biggest users of the new Ethereum mechanism EIP-7702 are theft gangs (rather than phishing organizations). EIP-7702 allows for the automatic transfer of funds from wallets with leaked private keys or mnemonic phrases through authorizations, with over 97% of EIP-7702 delegations pointing to theft contracts.

ChainCatcher message, Slow Mist's Yu Xian posted on platform X, stating that the "most High" users of the new mechanism EIP-7702 are actually coin theft gangs (not phishing gangs), which facilitate the automatic transfer of related funds from wallet addresses with leaked private keys/mnemonic phrases... Over 97% of EIP-7702 delegations are authorized to such coin theft contracts.

ChainCatcher news, according to Beincrypto, the blockchain security platform Scam Sniffer has disclosed that the notorious phishing organization Inferno Drainer has recently launched a new type of attack utilizing the upcoming EIP-7702 feature in Ethereum, resulting in individual user losses of up to $150,000.EIP-7702 is a proposal in the Ethereum Pectra upgrade that allows external accounts (EOA) to temporarily act as smart contract wallets during transactions. Attackers exploit this by using authorized MetaMask wallets to batch transfer user assets, rather than directly controlling wallet permissions.Yuxian, the founder of Slow Mist Technology, stated that such attacks have evolved from traditional private key theft to utilizing the "execute" command to perform malicious authorizations in the background. Security experts recommend that users regularly check their token authorization status and use tools like Etherscan to identify abnormal delegation behaviors to mitigate potential risks.