Ethereum: The 2025 Wallet Upgrade Thieves Turned Into a One-Signature Drain

On 24 May 2025, an Ethereum user clicked through what looked like a routine token swap and signed. The signature did not approve a swap. It handed control of the whole wallet to someone else, who emptied it of about $146,551 in one go. The thief never saw the victim's password or recovery words. One signature was enough.

The anti-fraud service Scam Sniffer flagged the theft. Yu Xian, founder of the security firm SlowMist, traced it to Inferno Drainer, a phishing-for-hire operation that had announced its own closure in November 2023 and never actually stopped. Check Point Research reported that same month that Inferno's kit had robbed more than 30,000 wallets of at least $9 million in the previous six months alone.

What made this case new was the tool. Seventeen days earlier, Ethereum had switched on a feature called EIP-7702, and the thieves had already learned to use it.

A power of attorney for code

An Ethereum Improvement Proposal, or EIP, is a numbered rule change to the network, roughly what a rulebook amendment is to a stock exchange. EIP-7702, co-written by Ethereum co-founder Vitalik Buterin, went live on 7 May 2025 as part of an upgrade called Pectra.

Until then, Ethereum had two kinds of account. An ordinary wallet, the kind most people hold in apps such as MetaMask, is controlled by one secret key and can only do one simple thing per signature: send this, approve that. A smart contract is code that moves money by itself, following rules written in advance. EIP-7702 let an ordinary wallet borrow a contract's powers. The owner signs a short authorisation pointing the wallet at a piece of code, and from then on the wallet behaves as that code says, while keeping its address and its money.

The idea was convenience. A user could bundle ten actions into one signature, much as a company signs a single cover sheet for a batch of payments, or let someone else pay the network fees. MetaMask built its own "smart account" code for exactly this. The Ethereum Foundation pointed out the safeguards: an authorisation works on one blockchain only by default, and the owner can cancel or replace it at any time.

The risk was equally plain. A signature that hands a wallet to code is, in effect, a power of attorney. If the code belongs to a thief, the thief can do anything the owner could. Some older contracts also assumed that anything calling them from an ordinary wallet must be a human; that assumption stopped holding.

How the drain works

The May 2025 thieves did not even need code of their own. According to Yu Xian, they used MetaMask's genuine delegation contract, which the victim's wallet already pointed to, and fed it a batch of instructions. To the victim it looked like one ordinary signature. Inside the batch were approvals letting the thief move the victim's tokens, and the transfers that moved them. Because everything happened in one bundle, there was no second warning screen to catch it.

Later attacks went further, tricking victims into pointing their wallets at the thieves' own code. Security researchers at City University of Macau, CSIRO's Data61 and the University of Wollongong studied more than 150,000 such events involving 26,000 addresses and found the activity dominated by a small number of contract families linked to crime, reused from one theft to the next. They also noted that most wallet screens show the outer details of a transaction but not the authorisation buried inside it.

The sweepers

A second use appeared at the same time. Many wallets on Ethereum have keys that have already leaked, through malware, careless storage or earlier hacks. Thieves have long run robots that grab any money sent to such addresses. EIP-7702 made this cheaper: with the stolen key, a thief can point the wallet at a "sweeper" contract that forwards every incoming coin automatically.

In June 2025 the market maker Wintermute, a large trading firm, reported that over 80 per cent of all EIP-7702 delegations pointed to copies of the same basic sweeper code, a share it later put above 97 per cent. It nicknamed the family "CrimeEnjoyor". The operators had spent about 2.88 ETH, Ethereum's own coin, setting up sweepers on some 79,000 addresses, and Wintermute's analysis suggested they were making little from it. Wintermute rebuilt the sweeper code in readable form and published a version that displays a warning. Its point was that the feature itself was not the flaw: the keys were already lost.

The bigger thefts, and the count so far

The large losses came in August 2025. On 24 August a single victim lost about $1.54 million in staked ether, cbBTC (a token that stands for bitcoin on Ethereum) and NFTs (digital collectibles) after signing an EIP-7702 batch disguised as a normal transaction, according to Scam Sniffer. Another victim lost about $1 million the same month in a batch dressed up as a Uniswap trade.

Those two cases account for $2.54 million in Scam Sniffer's 2025 annual report, about 3 per cent of the $83.85 million it counted stolen through signature phishing across 106,106 victims that year. Together with the May case, documented EIP-7702 thefts come to at least $2.7 million. That is less than early headlines suggested. A widely repeated figure of "$12 million from 15,000 wallets" was in fact Scam Sniffer's total for all phishing in August 2025, by every method.

As of October 2026 the feature remains part of Ethereum, used legitimately by wallet makers including MetaMask and abused by a minority. Scam Sniffer's 2025 report still ranked older tricks, such as "permit" signatures that grant spending rights, as the cause of most large losses. No one has been charged over the EIP-7702 thefts, and Inferno Drainer's operators have never been publicly identified.