We didn't see the 63% before the math hit us. 3.66 million EIP-7702 transactions since the Pectra upgrade on May 7, 2025. And 2.3 million of them—63%—were malicious. That's not a bug. That's a feature of a broken assumption.
Context: EIP-7702 is the Ethereum upgrade that lets regular EOA addresses (the ones you've been using since 2015) behave like smart contracts. No migration to a new wallet. No seed phrase change. Just a delegation code that gives your address the power of a contract. The narrative was beautiful: “Account abstraction without the friction.” The USENIX security paper that dropped last week revealed the ugly truth: the friction is now inside your wallet.
Core: I've been auditing smart contracts since 2017—the Golem pre-sale audit taught me that the most dangerous vulnerabilities are the ones that change the fundamental semantics of a system. EIP-7702 does exactly that. It retroactively invalidates every security assumption built on msg.sender == tx.origin. That check was the last line of defense against phishing in DeFi. Now it's a lie.
The data is stark. The report analyzed 228 billion historical transactions to build a baseline. Then they ran the numbers on the 3.66 million EIP-7702 transactions. 2.3 million were malicious. $2.36 million directly stolen. Another $10.14 million exposed through 500 CREATE2 contracts that haven't been deployed yet. The attackers didn't break the code. They exploited the design.
Here's the mechanism: EIP-7702 allows an EOA to delegate to any contract. The contract can be a benign wallet router, a DeFi aggregator, or a phishing trap. The user signs a single authorization transaction, and their address becomes a proxy for the delegated code. The malicious contracts are automated scripts that re-bind after detection. The report found 242 unique malicious contracts, many using time-triggered logic to avoid manual oversight.
Based on my experience modeling Uniswap V2 liquidity in 2020, I recognized the pattern. The incentives are asymmetric. The attacker’s cost per malicious transaction is negligible. The user’s cost of a single mistake is the entire wallet. The 63% malicious rate isn't an anomaly. It's the equilibrium of a system where the defensive layer was designed for a world that no longer exists.
The old safeguards are gone. tx.origin checks are useless. Contract verification is harder because the EOA can change its delegated code at any time. The 500 undiscovered CREATE2 contracts represent a ticking time bomb: they can be deployed at any future block with new malicious logic.
Contrarian: The market hasn't priced this in. The total losses are small relative to Ethereum’s $300B+ market cap. But the narrative decay is real. The EIP-7702 story was supposed to be about user experience and innovation. Now it's about trust erosion. The contrarian thesis: EIP-7702 is a net negative for Ethereum's security posture in the short term. The upgrade makes Ethereum more user-friendly for the sophisticated, but more dangerous for the average user. The wallet providers are now forced to build a new layer of security—delegation white-lists, real-time monitoring, zero-trust authorization APIs. That’s not a feature. That’s a tax on the original design.
I wrote a similar analysis during the Terra collapse in 2022. The narrative was “algorithmic stability.” The reality was infinite growth dependency. EIP-7702 is different—the code works. But the narrative around it is broken. The upgrade was sold as frictionless, but the friction was just moved from the user’s onboarding to the user’s security consciousness.
Takeaway: The next narrative cycle will be about “delegation security.” We’ll see a new wave of infrastructure startups building white-listing services, real-time revocation dashboards, and automated contract scanning for EIP-7702. The window is 12 months. After that, the attackers will have already adapted. Code is law, but liquidity is truth. And right now, the liquidity is bleeding into a broken trust model.