63% of EIP-7702 authorization transactions involve malicious contracts, research reveals wallet authorization risks

Odaily reports: An empirical study presented at USENIX Security 2026 shows that among the approximately 3.66 million early EIP-7702 authorization transactions across seven chains, about 63% were associated with malicious contracts; confirmed losses exceed $2.3 million, and 924 malicious contracts were identified. Most attacks use phishing to trick users into signing authorizations that delegate their wallets to sweeper contracts. On-chain analysis shows that in today's anomalous outflow event from Binance hot wallets, attackers exploited EIP-7702 authorizations signed by hot wallets including Binance 14 to delegate accounts to pre-deployed malicious sweeper contracts, then transferred assets in bulk within minutes. Estimates from multiple parties put the scale in the billions of dollars, and Tether, Circle, and others have frozen some stablecoins. This incident aligns with the risks identified in the research: whether through private key leakage or abuse of signing systems, once attackers obtain a legitimate authorization signature, EIP-7702 grants them persistent execution control over the account until the authorization is revoked.