Ethereum Pectra Upgrade is Largely Benefitting Crypto Theft Gangs

Monicah W

Ethereum’s recently introduced smart wallet feature, EIP-7702, is under scrutiny after blockchain security researchers uncovered cybercriminals’ misuse of it. Following the Pectra upgrade, several wallet providers have begun integrating EIP-7702 features.

Analysts at Wintermute, a crypto trading firm, noted that attackers used 97% of EIP-7702 wallet delegations to deploy contracts designed to drain funds from unsuspecting users.

Hackers Use Ethereum’s EIP-7702 to Automate Mass Wallet Drainings

EIP-7702 temporarily allows externally owned accounts (EOAs) to operate as smart contract wallets. The upgrade enables features like transaction batching, spending limits, passkey integration, and wallet recovery—all without changing wallet addresses.

While these upgrades aim to enhance usability, malicious actors are leveraging the standard to speed up fund extractions.

Instead of moving ETH manually from each compromised wallet, attackers now authorize contracts that automatically forward any received ETH to their own addresses.

“No doubt attackers are one of the early adopters of new capabilities. 7702 was never meant to be a silver bullet and it does have great use cases,” Rahul Rumalla, Chief Product Officer at Safe, said.

Wintermute’s analysis shows that most of these wallet delegations point to identical codebases designed to “sweep” ETH from compromised wallets.

Ethereum's EIP-7702 Transactions Delegate Approval.
Ethereum’s EIP-7702 Transactions Delegate Approval. Source: Dune

These sweepers automatically transfer any incoming funds to attacker-controlled addresses. Out of nearly 190,000 delegated contracts examined, more than 105,000 were linked to illicit activity.

Koffi, a senior data analyst at Base Network, explained that over a million wallets interacted with suspicious contracts last weekend.

He clarified that attackers didn’t use EIP-7702 to hack the wallets but to streamline theft from wallets with already exposed private keys

The analyst furthered that one standout implementation includes a receive function that triggers ETH transfers the moment funds land in the wallet, eliminating the need for manual withdrawal.

Yu Xian, founder of blockchain security firm SlowMist, confirmed that the perpetrators are organized theft groups, not typical phishing operators. He noted that EIP-7702’s automation capabilities make it particularly attractive for large-scale exploits.

“The new mechanism EIP-7702 is used most by coin stealing groups (not phishing groups) to automatically transfer funds from wallet addresses with leaked private keys/mnemonics,” he stated.

Despite the scale of the operation, there are no confirmed profits so far.

Ethereum EIP 7702 Malicious Actors' Address.
Ethereum EIP 7702 Malicious Actors’ Address. Source: Dune

A researcher at Wintermute noted that attackers have spent about 2.88 ETH authorizing over 79,000 addresses. One address alone executed nearly 52,000 authorizations, yet the target address has not received any funds.

The post Ethereum Pectra Upgrade is Largely Benefitting Crypto Theft Gangs appeared first on BeInCrypto.

Related Posts

LIBRA Skyrockets 80% As President Milei Dissolves Investigation Task Force

LIBRA is up over 80% after Argentine President Javier Milei disbanded a task force dedicated to investigating the token. The Investigative Task Unit (UTI) forwarded all its information to the national prosecutor’s office.

This may or may not hamper some of the investigations, but there is strong pressure to investigate Milei’s financial ties. This act does nothing to change the criminal charges currently filed against Argentina’s head of state.

President Milei and the LIBRA Scandal

The LIBRA pump and dump was a major scandal for Argentina’s crypto community, especially because of President Javier Milei’s alleged involvement.

Criminal charges have been filed against Milei, and both the courts and legislature have been investigating him. However, these investigations may have reached a speed bump, according to local reports:

“The Government believes that the information collected [by UTI] was forwarded to the Public Prosecutor’s Office, and that the [UTI] has fulfilled its assigned task,” read a decision officially dissolving the UTI. It was signed by President Milei and Minister of Justice Mariano Cúneo Libarona.

LIBRA was a massive rug pull that severely diminished Milei’s public approval in Argentina. However, the Solana-based meme coin itself is still alive.

Since its launch and collapse in February, LIBRA has never reclaimed anything like its former success, but it’s rallying today. The asset climbed over 80% before dropping slightly.

LIBRA Price Performance
LIBRA Price Performance. Source: CoinGecko

This isn’t the first time that LIBRA has spiked in accordance with President Milei’s statements and actions. For example, it briefly recovered 60% after Milei reposted a purchasing guide, but a disastrous TV interview sent it crashing again the same day.

Currently, LIBRA is an orphaned meme coin, which does not generally suggest long-term stability.

However, one aspect of the incident does seem easier to predict. Even if the LIBRA-specific task force has been disbanded, several investigations are targeting President Milei’s exact involvement in the project.

Last week, a federal judge ordered the release of financial records from Milei, his sister, and three other associates. These figures also had their assets frozen.

Additionally, domestic LIBRA scrutiny isn’t the only thing that Milei has to worry about. Many LIBRA investors were US citizens, sparking the possibility that American enforcement agencies could prosecute him.

This has not happened, but local media claimed that some of these investors are filing a class-action suit. So much scrutiny will not simply vanish overnight.

The post LIBRA Skyrockets 80% As President Milei Dissolves Investigation Task Force appeared first on BeInCrypto.