An Ethereum wallet linked to the ENS name sven.eth was drained of 9.1231 ETH — roughly $22.7K — plus 1.69 TAPEETH after an attacker used a malicious delegation under EIP-7702, Ethereum's account-abstraction upgrade, to take control of the account's execution, according to a security alert from blockchain security firm ExVul reported by The Crypto Times.
The loss is small by the standards of this month's incidents. The mechanism is not — and it left the wallet in a state that remains dangerous after the theft.
How the drain worked
According to the alert, the attacker did not exploit a decentralized exchange, manipulate a liquidity pool, or use a flash loan. Instead, the wallet owner had at some point signed an authorization under EIP-7702 — the Pectra-era change that lets ordinary private-key wallets temporarily execute smart-contract code without changing their address — pointing the wallet's execution to a contract deployed by the attacker.
The attacker then included that authorization in a sponsored transaction, meaning the victim neither initiated nor paid gas for the transaction that activated the delegation. Once active, the malicious code granted a hard-coded controller address — linked to the attacker's wallet — permission to act from the victim's account. In a single transaction, the controller called PodMining.claim() to mint TAPEETH rewards, then transferred the rewards and withdrew the account's 9.1231 ETH balance from the compromised wallet at 0xd8ba9e…4a28.
ExVul's alert states the incident was not caused by a vulnerability in the TAPEETH token or the PodMining protocol. The entry point was the signed authorization itself.
The exposure outlives the theft
The more urgent detail: ExVul says the malicious delegation was still active at Ethereum block 26,188,153 — after the funds were taken. EIP-7702 delegations do not expire when the transaction that established them completes. Any new assets deposited into a wallet with a live malicious delegation can be swept the same way.
The original private key retains the power to replace or clear the delegation — but only if the holder knows to use it. For the affected wallet, the recommended path is to stop depositing, clear or replace the delegation, and move remaining assets to a newly generated wallet. ExVul's transaction-level account has not been fully independently verified, but the cited addresses and transaction hash are public on Etherscan, and the attack pattern matches previously documented EIP-7702 abuse.
Not the first, and the signature is the vulnerability
Malicious 7702 delegations have been documented since the feature shipped. In September 2025, attackers used them to drain World Liberty Financial token wallets, with SlowMist founder Yu Xian warning that malicious delegations were being used to seize assets from compromised wallets. After the Pectra upgrade, trading firm Wintermute analyzed delegation activity and found more than 97% of delegations in its dataset were associated with malicious sweeper contracts.
The sven.eth case follows the template: the victim's own valid signature is the exploit. Whether the authorization was obtained through phishing, a fake frontend, or a bundled approval is unknown. What is known is the defensive gap most users still miss — revoking token allowances does not remove an EIP-7702 delegation, because delegated code carries account-level authority that is broader than any single allowance. Wallet owners can and should inspect their account's delegation status directly.
TrustGrade covers wallet-level attacks and the defenses against them. Verified trust data: trustgrade.ai.