The 3-Minute Heist: How EIP-7702 Turned a Wallet Into Its Own Robber
Three minutes and twenty-four seconds. That is all it took for 167,464 ETH and 63 tokens, including 1.615B USDT, to vanish from a Binance-labeled wallet after a single signed message installed an EIP-7702 delegation. Security researcher Odysseus of phylax.systems mapped the entire attack on-chain in a thread that is now going viral.
The timeline is chilling.
20:20:59 UTC: an EIP-7702 delegation authorization is installed on the wallet. 20:24:23: a different address calls sweep(). The wallet's own execution context now runs the attacker's contract, draining everything to 0x027…2ffe. Then at 20:41:23, it gets worse: the delegated wallet uses its owner role on a separate smart wallet to move another 780M USDC.
Why is this so dangerous? EIP-7702 lets a normal wallet temporarily run smart-contract code. The catch: the delegation persists, and that code can keep authorizing transfers without the owner ever signing again. The attacker's delegate even hard-coded a Tornado Cash-funded operator and rejected unrelated callers. This was a precision operation, not spray-and-pray.
The open question is how the signature was obtained: a stolen private key, or a malicious authorization tricked out of the owner. Either way, the lesson is the same.
Protect yourself:
1. Never sign an opaque authorization message you do not fully understand, especially anything mentioning delegation.
2. Check what code your address is delegated to and revoke anything you do not recognize immediately.
3. Split your holdings: hot wallets for activity, cold wallets for size.
4. Remember that delegated code inherits your permissions, including owner roles on other contracts.
One signature. No second confirmation. Over $2.4B in stablecoins alone, gone in under four minutes. EIP-7702 is powerful, and that power cuts both ways.