ExVul Identifies Ethereum (ETH) Wallet Drained of 9.1231 ETH via EIP-7702 Delegation

9.1231 ETH Drained From sven.eth via EIP-7702

An Ethereum (ETH) wallet tied to the name sven.eth lost 9.1231 ETH, worth roughly $22,770 at the Ethereum price when the findings were published, together with 1.69271471 TAPEETH, after a malicious EIP-7702 authorization placed the account under an outside party's control. The theft itself is documented on-chain. How the attacker came to hold the victim's signed authorization has not been established by anyone reporting on the incident so far. Blockchain security firm ExVul flagged the drain on October 14. Its alert, posted on X, describes an attacker-sponsored type-4 transaction that carried the victim's valid EIP-7702 authorization, with no flash loan or automated market maker manipulation anywhere in the flow. The transaction hash, 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee, is verifiable on Etherscan. Once the network processed that authorization, subsequent calls to the wallet executed the delegated contract's instructions inside the victim account. The mechanism at the center of the case, EIP-7702, is Ethereum's account-abstraction feature: it lets an ordinary externally owned account delegate execution to smart contract code, enabling sponsored fees, transaction batching and more flexible wallet permissions. The feature shipped with Ethereum's Pectra upgrade and has backed legitimate uses since, including third parties covering network fees. The same design becomes an attack surface when the delegated code is hostile. Ethereum's own specification warns that poorly designed or malicious delegation contracts can hand an outside party extensive control over the affected account. The exposed account is the crypto wallet address 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28, which the alert links to sven.eth, an Ethereum (ETH) Name Service style identifier; readers new to such names can consult our guide to getting a .ETH domain. The $22,770 figure covers the ETH side alone, and the alert fixes no dollar value on the token side of the loss. Comparable delegation abuse has been tracked across Ethereum since 2025, a pattern this case fits.

ExVul's investigation attributed the attack to the address 0x9208097c007be15e28b20e94e66870a3f9f820bc, with the malicious delegation pointing to 0x0366b55f948a688888ca6e029ad0831f6ec260d1. The attacker paid the transaction fee and submitted the signed authorization himself, so the wallet owner never funded or broadcast the transaction that activated the hostile code. Once activated, the code ran under the victim's account context: it invoked the PodMining.claim() function, moved the resulting TAPEETH rewards to the controller, and withdrew the wallet's ETH balance. The firm stated the exploit is not a TAPEETH or PodMining bug. Its analysis identified the account authorization as the entry point, with no evidence of an exploit involving liquidity pools or price manipulation. ExVul did not establish how the attacker obtained the victim's authorization; its public findings name no phishing site, malicious application or compromised signing interface. The warning that followed concerns how EIP-7702 delegations persist. A delegation, once set, does not clear itself when the transaction ends: the authorized contract stays attached to the wallet until the owner replaces or removes it. The owner retains control through the original private key and can reset delegation by authorizing the zero address, but hostile code may remain dangerous until that change is processed. ExVul recorded the malicious delegation as still active at Ethereum (ETH) block 26,188,153 and warned against sending new assets to the address while it persisted. Its recommendation was to clear or replace the authorization and move surviving assets out of the exposed hot wallet into a cold wallet. The alert did not establish whether the victim subsequently removed the code or recovered any assets, and no reimbursement arrangement, recovery transaction or law enforcement action has been identified. The case echoes earlier delegation warnings: in May 2025, market maker Wintermute found that more than 97% of observed EIP-7702 delegations pointed to identical sweeper contracts able to transfer incoming ETH to attacker-controlled addresses. The method here differs from bridge-level thefts such as the recent Autheo bridge exploit.

How the Signature Was Obtained Stays Open

Taken together, the on-chain record and ExVul's post-mortem settle the mechanism: a signed EIP-7702 authorization, activated by an attacker-paid type-4 transaction, let code inside the victim account claim rewards and sweep the balance. The root cause sits with the authorization, and the remediation follows from it: clear or replace the delegation, then move surviving funds to a hardware wallet. What nobody has settled is the first link in the chain, the step that produced the victim's signature. No phishing site, malicious app or compromised signer has been named. The alert records the delegation as active at block 26,188,153; whether the owner has cleared it since sits outside the documented record.