Academic Research Warning Comes True: 63% of EIP-7702 Authorizations Involve Malicious Contracts

BlockBeats news, October 30 — An empirical study by USENIX Security in 2026 shows that among approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts, with confirmed losses exceeding $2.3 million and 924 malicious contracts identified. Most attacks lured users into signing authorizations through phishing, delegating their wallets to sweeper contracts. The study forms a direct contrast with today's abnormal outflow event from Binance hot wallets.

On-chain analysis shows that attackers obtained EIP-7702 authorizations signed by hot wallets such as Binance 14, delegating them to pre-deployed malicious sweeper contracts, and then transferred out assets in batches within minutes (multi-source estimates involve a scale of tens of billions of dollars, with Tether, Circle, and others having frozen some stablecoins). Whether it was private key leakage or abuse of the signing system, this incident confirms the core risk identified by the study: once a legitimate authorization signature is obtained, EIP-7702 can grant attackers persistent execution control over the account until it is revoked.