Ethereum News Today: EIP-7702 Phishing Scams Drain Over $200k in Ethereum Transactions

Phishing attacks exploiting the Ethereum Improvement Proposal (EIP-7702) have triggered widespread alerts within the cryptocurrency community. Scam Sniffer, a leading anti-fraud analytics platform, reported that malicious actors are leveraging EIP-7702 functionalities to disguise phishing attempts as legitimate Uniswap transactions, resulting in reported losses exceeding $146,551 in one instance and $66,000 in another [3]. These scams involve routing transactions through the Uniswap Universal Router, making them appear as routine decentralized exchange (DEX) trades rather than fraudulent activity [2].

The attack method has evolved from previous phishing strategies, which primarily used batch approvals to drain funds. Now, attackers are executing batch transfers, allowing multiple token movements within a single transaction to bypass traditional detection mechanisms [1]. This shift has made it more difficult for users to recognize the malicious intent behind seemingly benign operations.

EIP-7702 was introduced to streamline multi-token transactions, enabling users to execute several transfers in a single operation. However, its adoption has inadvertently expanded the attack surface for cybercriminals. Scam Sniffer emphasized that the vulnerabilities in EIP-7702-related transactions highlight the need for greater user caution and improved security protocols [2]. Users are advised to scrutinize transaction details, avoid suspicious links, and verify the legitimacy of contract addresses before approving transactions.

The attacks have underscored a broader vulnerability in the Ethereum ecosystem, particularly for wallets that have upgraded to EIP-7702. As the volume of EIP-7702-based transactions increases, so does the likelihood of exploitation. Scam Sniffer and other monitoring entities are urging wallet providers and DEX platforms to implement enhanced safeguards, including on-chain monitoring tools and transaction validation mechanisms, to mitigate the risk of batch transfer abuse [1].

Despite growing awareness, the incidents suggest that many users remain unaware of the risks associated with EIP-7702 upgrades. Security experts recommend that users consider reverting to standard transaction formats until more secure alternatives are available. The repeated occurrence of similar attacks indicates a pattern rather than isolated events, raising concerns about the potential scale of future incidents [3].

Scam Sniffer continues to monitor the situation closely, issuing regular updates on newly identified threats. The repeated warnings highlight the urgent need for both technical and educational responses within the Ethereum community to ensure the long-term security and trust of the network.

Source: [1] Beware of bulk transfer phishing attacks targeting EIP-7702 ... (https://www.panewslab.com/en/articles/8d7dbd2f-df75-447c-92b1-f30de5e92a6c)

[2] EIP-7702 Upgrade Addresses Targeted in Phishing Attacks (https://www.binance.com/en/square/post/08-05-2025-eip-7702-upgrade-addresses-targeted-in-phishing-attacks-27885268333906)

[3] Scam Sniffer | Web3 Anti-Scam - X (https://x.com/realScamSniffer/status/1952409546607284565)