ExVul traces a sven.eth wallet drain to one EIP-7702 signature
ExVul reports an attacker drained 9.1231 ETH, about $22,770, from the sven.eth wallet using an EIP-7702 authorization its owner had signed. ExVul says neither PodMining nor TAPEETH had a flaw; cryptotimes notes the account is not yet independently confirmed.
The Investor · Invest desk
Three figures. ExVul says the sven.eth wallet lost 9.1231 ETH, valued at about $22,770 at detection. It also lost 1.69271471 TAPEETH tokens, with no separate dollar valuation given. ExVul's alert says the malicious delegation remained active at Ethereum block 26,188,153, after the reported theft.
- 9.1231 ETH ETH lost from the sven.eth wallet, per ExVul, claim 11 valued at about $22,770 at detection
- 1.69271471 TAPEETH TAPEETH tokens also lost, claim 12 no separate dollar valuation given
- 26,188,153 Ethereum block Block where malicious delegation remained active, claim 5 after the reported theft, per the alert
| Figure | Value | Note | Claim |
|---|---|---|---|
| ETH lost from the sven.eth wallet, per ExVul | 9.1231 ETH | valued at about $22,770 at detection | 11 |
| TAPEETH tokens also lost | 1.69271471 TAPEETH | no separate dollar valuation given | 12 |
| Block where malicious delegation remained active | 26,188,153 Ethereum block | after the reported theft, per the alert | 5 |
What happened
- The wallet also lost 1.69271471 TAPEETH tokens, and ExVul did not give them a separate dollar valuation.
- The attacker paid for a sponsored type-4 transaction carrying the owner's signed authorization, so the owner did not have to fund or broadcast anything.
- Under the delegated code, a hard-coded controller address called PodMining.claim(), moved the TAPEETH rewards and withdrew the wallet's ETH balance.
- ExVul's alert says the malicious delegation was still active at Ethereum block 26,188,153, after the theft.
Why it matters
- constraint On ExVul's account PodMining and TAPEETH have nothing to patch, so no contract fix or protocol pause addresses this loss.
- exposure Until the delegation is replaced or cleared, new deposits to the sven.eth address could become accessible to the attacker.
- precedent Attackers used the same feature against WLFI token wallets in September 2025, so a signed delegation is a repeat route into wallets.
Divide $22,770 by 9.1231 ETH and the implied price is about $2,496 an ETH [10]. That is a mark from the moment of detection, so the dollar loss will drift with the market while the ETH count stays fixed [11].
ExVul put the method in one sentence: "No flash loan or AMM manipulation was involved." [4] We think the delegation framing holds on the evidence so far, and we can see two ways it could turn out incomplete.
The first is that the account is wrong in detail. It is one security firm's alert relayed by two outlets. Cryptotimes reported that the losses and the transaction sequence had not been independently confirmed against the full transaction record, because the alert's Etherscan link carried a shortened hash [13]. Crypto.news printed a full transaction hash [14], so a check against the chain is at least possible.
The second is that the signature was the last step of a theft that began elsewhere. When attackers drained WLFI token wallets with EIP-7702 in September 2025, SlowMist founder Yu Xian said they were using malicious delegations to seize assets from compromised wallets [8]. Neither report says how the sven.eth owner came to sign. That matters for the remedy too: only the original key can replace or reset the delegation, and only if that key remains secure [6]. If it was taken, the alert's advice to move the remaining assets to a newly secured wallet is the only step that works [7].
A transaction record showing the key was compromised before the authorization was signed would turn this from a delegation story into a key-management story. Short of that, we would go with ExVul: the theft needed a signature, and the contracts it touched needed no flaw [3].
What to watch
- Whether the delegation on the sven.eth address is cleared or replaced after block 26,188,153, which only the original key can do.
- Whether ExVul or another firm publishes transaction-level confirmation using a complete hash, since cryptotimes said the alert's own link was shortened.
- Whether anyone establishes how the owner came to sign: a deceived signer and a stolen key lead to different conclusions.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap−5
- Incentives
- Insufficient
- Confidence50
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The attacker submitted a sponsored type-4 transaction containing an EIP-7702 authorization signed by the victim; the attacker paid the fee, and the wallet owner did not need to fund or broadcast the transaction that activated the delegation.
- [2]
The attacker-controlled code contained a fixed address authorized to operate the wallet; the controller invoked the PodMining.claim() function, transferred the resulting TAPEETH rewards and withdrew the wallet's ETH balance.
- [3]
ExVul attributed the theft to malicious wallet authorization, not to a vulnerability in PodMining or TAPEETH.
- [4]
ExVul said: "No flash loan or AMM manipulation was involved."
- [5]
The security alert states that the malicious delegation remained active at Ethereum block 26,188,153, even after the reported theft.
- [6]
EIP-7702 delegation is not automatically removed when the establishing transaction finishes, so new funds deposited into an account with malicious delegated code could become accessible to the attacker; the original wallet's private key can authorize a replacement or reset of the delegation, provided it remains secure.
- [7]
For the affected sven.eth wallet, the alert recommends avoiding new deposits, clearing or replacing the malicious delegation and moving any remaining assets to a newly secured wallet; the delegation's status as of publication has not been independently verified.
- [8]
In September 2025, hackers used EIP-7702 to drain World Liberty Financial (WLFI) token wallets; SlowMist founder Yu Xian said attackers were using malicious delegations to seize assets from compromised wallets when tokens became available.
- [9]
Type-4 transactions are a transaction format introduced through EIP-7702 as part of Ethereum's Pectra upgrade in May 2025.
- [10]
The ETH valuation implies a price of about $2,496 per ETH at detection.
- [11]
Security firm ExVul reported that a wallet associated with sven.eth lost 9.1231 ETH, valued at approximately $22,770 at detection, after an attacker used a malicious EIP-7702 authorization to gain control of the account.
- [12]
The wallet also lost 1.69271471 TAPEETH tokens; ExVul did not provide a separate dollar valuation for the TAPEETH tokens.
- [13]
Cryptotimes reported that the losses and transaction sequence had not yet been independently confirmed against the full transaction record, and that the alert's Etherscan link contains a shortened transaction hash, preventing a conclusive transaction-level verification.
- [14]
Crypto.news listed the transaction hash as 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee and linked it to a sponsored type-4 Ethereum transaction.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- crypto.newsEthereum user loses $22K in EIP-7702 wallet attack
1 article · October 14, 2026
- cryptotimes.ioEthereum Wallet Loses $22.7K in EIP-7702 Delegation Attack
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.