Ethereum's EIP-7702 Becomes New Attack Vector in Evolving Crypto Phishing Scams

A prominent phishing group known asInferno Drainerhas reportedly exploited a new Ethereum wallet feature—EIP-7702—to siphon nearly $150,000 in digital assets from unsuspecting users. This marks a significant shift in phishing tactics, as scammers begin to embed their schemes within legitimate smart wallet functionalities.

The incident was first identified by Scam Sniffer, a Web3 anti-scam platform, which detected suspicious batch transactions initiated through a MetaMask wallet recently upgraded to support EIP-7702. The victim unknowingly approved an "execute" command that processed hidden batch authorizations, granting hackers access to their tokens.

According to Yu Xian, founder of the blockchain security firm SlowMist, this method differs from traditional wallet hijackings. “They used a delegated wallet already pre-approved through EIP-7702, allowing silent batch approvals,” Xian explained. The attacker exploited the wallet’s flexible permissions to bypass user consent in real-time, using what is effectively a backdoor.

EIP-7702, part of Ethereum’s ongoing smart wallet evolution, is designed to improve the efficiency and flexibility of wallet interactions. However, as this case illustrates, its increased sophistication also introduces new vulnerabilities.

“This is a turning point,” said Xian. “Phishing groups are no longer relying solely on outdated tricks. They’re adapting to every upgrade the ecosystem makes—and fast.”

This exploit highlights a growing trend in the crypto space. Last month alone, over $5 million was stolen from more than 7,500 users through phishing campaigns employing similar token authorization tactics. The line between user error and system vulnerability is becoming increasingly blurred.

Security experts now urge all wallet users to take proactive measures:

Community advocates are also ramping up educational efforts. Social media influencers, Web3 developers, and cybersecurity firms are pushing for clearer guidelines on how to manage permissions in smart wallets and how to identify evolving scams.

For Ethereum users, this incident serves as a stark reminder: innovations like EIP-7702 may streamline usability, but they also open new attack surfaces. Until wallet interfaces improve in transparency and phishing countermeasures are more robust, the best defense remains vigilance.

• Regularly audit token authorizationsvia trusted explorers.
• Avoid interacting with unknown dApps or clicking on unverified links.
• Use hardware walletswhenever possible to reduce remote access risks.
• Enable multi-factor authenticationfor additional protection.