sven.eth-Linked Wallet Drained After Malicious EIP-7702 Delegation

How the delegation was used

EIP-7702 lets an externally owned account temporarily act with smart contract-like behavior by delegating execution to code specified in a signed authorization. Once that authorization is submitted onchain, the delegated contract can run when relevant calls are made from the account.

In this case, ExVul said the attacker sponsored the transaction fee and broadcast the authorization after obtaining the victim’s signature. That meant the wallet owner did not need to send or fund the triggering transaction for the malicious code to be activated.

According to the firm’s account of the incident, the delegated code then operated under the victim’s address and transferred out the assets. ExVul attributed the theft to the authorization mechanism being abused rather than to a flaw in the affected token or reward system.

No bug identified in TAPEETH or PodMining

ExVul said the incident was not caused by a vulnerability in TAPEETH or in PodMining. Instead, the entry point was the wallet authorization itself, which gave outside code the ability to act through the user’s account.

That distinction matters because the losses were tied to compromised wallet permissions, not to an exploit in the token contract or the related application. The source article did not report any evidence that the underlying contracts were breached.

Risk remained after the drain

ExVul said the malicious delegation was still active at Ethereum block 26,188,153. Because an EIP-7702 delegation can remain attached to a wallet until it is cleared or replaced, the threat did not necessarily end when the initial theft was completed.

The firm warned that any new assets sent to the address could also be at risk while the authorization remains in place. It advised that recovery steps should be handled carefully, since the delegated contract could still allow malicious instructions to be executed from the account.

Broader security concerns around EIP-7702

The incident follows earlier warnings about the security risks tied to delegated wallet permissions under EIP-7702. The source article noted that Wintermute had previously identified widespread delegations linked to automated fund sweepers, and that other later cases also raised concerns about compromised wallet permissions.

EIP-7702 includes safeguards, but the model can still create serious exposure if a user signs a malicious authorization or if a delegation contract is poorly designed. In this case, ExVul said it identified the malicious contract, the controller, and the affected wallet, but it had not determined whether the victim had since replaced or removed the authorization.