Security Incident Involving Ethereum Wallet
A significant security incident has surfaced involving an Ethereum wallet tied to the account sven.eth, which has suffered a loss of 9.1231 ETH, roughly equivalent to $22,770, along with 1.69271471 TAPEETH tokens. This breach occurred after an attacker employed a malicious authorization leveraging Ethereum’s EIP-7702 standard to take control of the wallet’s assets. Blockchain security experts at ExVul disclosed the details of the breach on October 14, indicating that the attack stemmed from a transaction funded by the perpetrator that executed previously permitted malicious code authorized by the wallet’s owner.
Details of the Breach
The particular Ethereum wallet at risk is identifiable as 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28, while the malicious counterpart is traced back to an address beginning with 0x9208. ExVul’s investigation highlighted that the authorization granted through EIP-7702 enabled the execution of smart contract code with the wallet’s permission, leading to the theft of the aforementioned assets without any direct manipulation of decentralized finance (DeFi) protocols.
Transaction Analysis
Upon examining the incident, ExVul traced the specific transaction using the hash 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee, which linked it to a sponsored type-4 Ethereum transaction. This transaction allowed the malicious code to operate within the context of the compromised wallet. Significantly, the security analysis emphasized that no flash loans or automated market maker (AMM) manipulations took place during this episode. Instead, the attacker executed a type-4 transaction containing a valid EIP-7702 authorization that had been signed by the victim, thus facilitating unauthorized asset transfers once the code was processed by Ethereum.
Execution of Malicious Code
The malicious actor initiated the PodMining.claim function within the scam code, successfully claiming TAPEETH rewards and subsequently withdrawing all ETH from the victim’s wallet. ExVul clarified that the security breach was a result of the authorization mechanism and not a flaw within the TAPEETH or PodMining systems themselves. Nonetheless, they could not determine how the attacker initially gained access to the victim’s authorization, nor did they identify a specific phishing site or malicious application implicated in the attack.
Ongoing Risks and Recommendations
ExVul’s findings reinforced the idea that the malicious delegation remained active in the Ethereum blockchain at block 26,188,153, which poses ongoing risks. Users must understand that setting a delegation under EIP-7702 does not inherently negate it after the transaction’s completion; the authorization persists until the account owner actively clears or reassigns it. The Ethereum security guidelines further explain that control can be regained through the original private key, and users can reset their delegations by authorizing a “zero address”.
Given the potential threat, ExVul has advised users against transferring additional assets into the affected wallet until the malicious delegation is addressed, as this could leave new funds vulnerable to the same exploits. They urged the wallet owner to nullify the dangerous authorization and, if necessary, move the remaining assets to a safer wallet, while highlighting the importance of taking caution as malicious code could operate during the delegation’s duration.
Conclusion
This incident serves as a stark reminder of the vulnerabilities associated with the EIP-7702 authorization system. Security researchers have previously warned of similar scams involving such delegations, citing instances in which malicious actors utilized compromised wallet permissions to manipulate users’ accounts. Incidents from 2025 and 2026 exemplify the growing concerns over delegated permissions that could allow unauthorized asset claims or transfers.
ExVul has provided a comprehensive account of this incident, clarifying the nature of the exploit and underscoring the broader implications for users of the Ethereum network. The investigation aims to enhance awareness regarding the risks tied to delegated smart contract functionalities, proposing that users always verify the permissions bestowed upon delegated codes to mitigate exposure to future attacks.
