Account Abstraction just made Ethereum wallets easier to use… and easier to hack. Here’s what happened after the Pectra upgrade and what to watch out for. 👇

1/8 In May, Ethereum’s Pectra upgrade expanded support for Account Abstraction (AA).

One key addition? EIP-7702, a proposal that allows your regular wallet (EOA) to temporarily act like a smart contract wallet. Sounds great, right?

2/8 It is great, for user experience.

EIP-7702 enables features like:

Paying gas with any token. Add spending limits. Support passkeys. Bundled transactions.

But there’s a dark side. And hackers have noticed.

3/8 The core problem?

With just one signature, users can unknowingly give malicious smart contracts full access to their funds.

This wasn’t theoretical, unfortunately, it’s already happening.

4/8 Since May 7, over 290K EOAs have delegated control to smart contracts using this new functionality.

This marks a major shift in how accounts interact on Ethereum, both in terms of flexibility and responsibility.

5/8 On May 20, GoPlusSecurity flagged one of the first phishing attacks using EIP-7702.

One signed transaction = all assets instantly drained.

The malicious contract had ~300 approvals before it was noticed.

6/8 By now, according to the Wintermute Dune dashboard, around 82% of all known EIP-7702 delegations are linked to phishing or scams.

7/8 So what can you do?

Stay alert.Here’s how to protect yourself:

Only delegate via official apps/sites. Don’t click unknown links. Read the contract code (or ask a friend who can). Double check all signature requests.

8/8 EIP-7702 is not a failure. It opens real possibilities for the future of smart wallets.

But just like DeFi itself, greater power = greater responsibility.

One careless click could now cost everything.

Please, stay smart. Stay safe.

Note: full post is available via link

Source: https://dune.com/wintermute_research/eip7702