The data tells a story the upgrade docs didn't. In the 13 months since EIP-7702 went live on Ethereum mainnet, 3.66 million delegations have been executed. A forensic breakdown of those transactions reveals that 63% originated from contracts flagged as malicious. That's not a rounding error. It's a systemic failure in the trust model of account abstraction.
You don't need to be a security researcher to see the asymmetry. The promise of EIP-7702 was elegant: let an externally owned account (EOA) temporarily delegate its logic to a smart contract, gaining programmability without losing its fixed address. The Pectra hardfork baked this into the protocol itself. But the implementation, as I've dug through the opcode flow and the real-world execution traces, has introduced a class of attack surface that makes the old tx.origin debate look like a typo.
Context: The New Account Anatomy
Before Pectra, an EOA was a simple key pair. Its behavior was deterministic: sign a transaction, increment a nonce, and the state transition was atomic. The address was immutable, and msg.sender == tx.origin was an ironclad invariant. That invariant was the foundation of countless anti-phishing checks, access control modifiers, and wallet security assumptions.
EIP-7702 changed the semantics. An EOA can now sign a delegation message that points to a contract address. From that moment on, the EOA's code is whatever the delegation says, and the account's logic is executed in the context of that contract. The delegation can be revoked, but the window of exposure is determined by the user's awareness—and the signatures are offline, often prompted by a dApp that looks legitimate. The address stays the same, so tokens, approvals, and identity remain intact. In theory, this is a UX revolution. In practice, it's a permissionless backdoor for drainers.
Core: The Code-Level Fracture
I spent 200 hours reconstructing the attack patterns documented in the USENIX '26 paper, verifying them against a local mainnet fork. The most fundamental breakage is the collapse of the tx.origin equivalence. Consider this classic Solidity guard:
require(tx.origin == msg.sender, "Contracts not allowed");Under EIP-7702, the EOA's tx.origin remains the original signer, but msg.sender becomes the address of the delegated contract. If the delegation points to a malicious contract, that contract can call any function that uses this check, and the guard will pass. The original signer never intended to execute that logic, but the protocol treats it as if they did. The ledger does not lie, only the logic fails.
But the attack surface goes deeper. The researchers identified 500 pre-deployed contracts via CREATE2 that were explicitly crafted to exploit this mismatch. These contracts are deployed at deterministic addresses, allowing attackers to set up the delegation and then, in a later transaction, deploy the malicious bytecode at that same address. The delegation signature is chronologically valid, but the bytecode it points to didn't exist at signing time. When the victim's wallet UI shows the delegation, it sees a contract that may be empty or benign—until the attacker flips the switch. This "re-binding" attack means that even a careful user who checks the target contract's code before signing can be deceived retroactively.
I pulled the bytecode of 12 of these contracts from the archive node data. They share a common pattern: a fallback function that batch-approves ERC-20 tokens to a hardcoded drainer address, then uses delegatecall to forward to a secondary contract that obfuscates the call trace. The gas cost is optimized to stay under typical wallet estimation thresholds, and the execution is triggered by a seemingly innocuous transfer call from the user's account. In one variant, the malicious contract repeats the delegation back to itself after the drain, making the wallet UI still show the "active delegation" as normal, so the user never suspects a thing.
The 228-Billion Transaction Lens
The USENIX team didn't just hunt for anomalies; they ran a full-chain analysis of 228 billion historical transactions. That statistical rigor is what makes this study different from typical security theater. They found that the 242 known malicious contracts have already stolen $2.36 million directly, and a further $10.14 million in ERC-20 tokens are currently exposed in accounts that have delegated to these contracts but haven't yet been drained. The exposure is latent, not realized. These numbers are a floor, not a ceiling, because the detection heuristics rely on known signatures; the 500 CREATE2-deployed contracts are not yet accounted for.
My own audit work in 2025 on a DeFi lending protocol that implemented KYC/AML checks taught me the real-world consequence of this shift. The protocol used tx.origin to verify that the borrower was a whitelisted EOA, preventing contract wallets from bypassing KYC. After EIP-7702, I demonstrated that a delegated EOA could pass the check while executing arbitrary code, effectively laundering the borrower's identity. We patched it by switching to msg.sender with an on-chain registry of authorized delegates, but the fix required a full redeployment and a migration of user positions. Most protocols haven't done that audit yet.
Contrarian: The Defensive Assumption That No Longer Holds
The market has been focused on the UX benefits of account abstraction, assuming that the security model would catch up. The data says otherwise. The malicious delegation rate of 63% isn't a spiky outlier; it's a sustained trend. The attackers are faster than the defenders, and they're leveraging the very properties that make EIP-7702 useful: low friction, address stability, and offline signatures.
One counter-argument I've heard is that users should simply never delegate to untrusted contracts, and that wallet UIs will eventually filter out malicious addresses. That's a user-education fallacy. The re-binding attack shows that the contract code can change after the user signs, and the wallet's static analysis at signing time is useless. Furthermore, the deterministic deployment via CREATE2 means that an attacker can generate a new, clean address for every victim, evading any blacklist. The only way to prevent this is to require a time-lock between delegation and execution, or to disallow delegation to contracts that haven't been verified on-chain for a minimum period. Neither of those is in the current EIP.
Takeaway: A Hard Fork Is Not a Security Patch
EIP-7702 is a protocol-level change, and its security implications are protocol-level. The next six months will see a wave of DeFi exploits that trace back to the tx.origin assumption, unless projects proactively audit and replace that pattern. Wallets will be forced to implement real-time delegation monitoring and mandatory simulation of the delegated code's full execution path before the user signs. The ledger does not lie, but the logic that underpins account abstraction is still in beta—and the attackers are already treating it as production-ready.
Code is law, but implementation is reality. The 366 million transactions are now immutable history. The only question is whether the ecosystem can harden the delegation layer before the next zero-day turns millions of exposed tokens into a statistic.