An Ethereum wallet associated with sven.eth has reportedly lost 9.1231 ETH, valued at approximately $22,770, and 1.69271471 TAPEETH tokens after an attacker used a malicious EIP-7702 authorization to gain control of the account. According to security firm ExVul, the attack involved an attacker-controlled address beginning with 0x9208 and was attributed to malicious wallet authorization, not a vulnerability in PodMining or TAPEETH. The security firm emphasized that "No flash loan or AMM manipulation was involved," with the exploit identified as not a TAPEETH/PodMining bug.
The investigation attributed the attack to 0x9208097c007be15e28b20e94e66870a3f9f820bc, with the victim's wallet identified as 0xd8ba9e5886b7000bace2c9dbdd0be98ac77d4a28. The malicious delegation pointed to 0x0366b55f948a688888ca6e029ad0831f6ec260d1. As reported by ExVul, the attacker submitted a transaction containing an EIP-7702 authorization signed by the victim, allowing code installed through Ethereum's EIP-7702 mechanism to operate with the wallet's permissions. The attacker-controlled code reportedly contained a fixed address authorized to operate the wallet, with the controller invoking the PodMining.claim() function and transferring the resulting TAPEETH rewards while withdrawing the wallet's ETH balance. The latest reports confirm the attacker used a sponsored transaction to execute the malicious code, allowing them to transfer funds without exploiting any DeFi protocol vulnerabilities.
EIP-7702 is part of Ethereum's account abstraction development, allowing externally owned accounts to temporarily gain smart contract functionality through delegated code. According to ExVul's findings, the attacker paid the transaction fee and submitted the signed authorization, with the wallet owner not needing to fund or broadcast the transaction that activated the malicious delegation. The signature supplied authority for the wallet to execute the attacker's code, which operated under the victim's account context. ExVul warned that the wallet's malicious delegation remained active at Ethereum block 26,188,153 after the reported theft, with the firm noting that setting a delegation does not automatically remove it when the transaction finishes. The latest incident highlights the risks in Ethereum's EIP-7702 delegation feature, which allows smart contract functionality but can be abused if authorizations are compromised.
ExVul warned users against transferring new assets into the affected address while the suspicious delegation remained active, as newly deposited funds could face the same exposure. The firm recommended clearing or replacing the authorization and moving remaining assets to a secure wallet, noting that the affected address may execute malicious instructions while the delegation persists. Ethereum's official security guidance explains that a wallet owner retains control through the original private key, including the ability to reset delegation by authorizing the zero address. However, malicious delegated code may remain dangerous until the change is successfully processed.
The latest attack follows previous warnings from blockchain security researchers about malicious account delegations. In May 2025, crypto market maker Wintermute identified widespread use of EIP-7702 contracts designed to automatically drain funds from compromised Ethereum wallets, with more than 97% of observed delegations pointing to contracts using identical code. A separate incident involving World Liberty Financial tokens in September 2025 raised similar concerns, while another Ethereum phishing incident in July 2026 demonstrated how dangerous wallet approvals can expose cryptocurrency holdings. ExVul's October 14 alert identified the malicious contract, controller address and affected account, but did not disclose whether the victim had since replaced the authorization or recovered any assets.
