Skip to content
Today
Sections

Invest Independently confirmed2 publishers 2 min read Published Updated

ExVul traces a sven.eth wallet drain to one EIP-7702 signature

ExVul reports an attacker drained 9.1231 ETH, about $22,770, from the sven.eth wallet using an EIP-7702 authorization its owner had signed. ExVul says neither PodMining nor TAPEETH had a flaw; cryptotimes notes the account is not yet independently confirmed.

The Investor · Invest desk

Send a correction

Illustration accompanying ExVul traces a sven.eth wallet drain to one EIP-7702 signature
Generated illustration
ETH and TAPEETH drained; delegation remained active Losses from the sven.eth wallet as ExVul reported them, and the block at which its alert says the malicious delegation remained active.

Three figures. ExVul says the sven.eth wallet lost 9.1231 ETH, about $22,770 at detection, and 1.69271471 TAPEETH tokens, with no separate dollar valuation. ExVul's alert says the malicious delegation remained active at Ethereum block 26,188,153, after the reported theft.

ETH and TAPEETH drained; delegation remained active
FigureValueNoteClaim
ETH lost from the sven.eth wallet, per ExVul9.1231 ETHvalued at about $22,770 at detection11
TAPEETH tokens also lost, per ExVul1.69271471 TAPEETHno separate dollar valuation given12
Block where malicious delegation remained active26,188,153 Ethereum blockafter the reported theft, per the alert5

What happened

  • The wallet also lost 1.69271471 TAPEETH tokens, and ExVul did not give them a separate dollar valuation.
  • The attacker paid for a sponsored type-4 transaction carrying the owner's signed authorization, so the owner did not have to fund or broadcast anything.
  • Under the delegated code, a hard-coded controller address called PodMining.claim(), moved the TAPEETH rewards and withdrew the wallet's ETH balance.
  • ExVul's alert says the malicious delegation was still active at Ethereum block 26,188,153, after the theft.

Why it matters

  • What it limits constraint On ExVul's account PodMining and TAPEETH have nothing to patch, so no contract fix or protocol pause addresses this loss.
  • Who's exposed exposure Until the delegation is replaced or cleared, new deposits to the sven.eth address could become accessible to the attacker.
  • What it sets up precedent Attackers used the same feature against WLFI token wallets in September 2025, so a signed delegation is a repeat route into wallets.

Divide $22,770 by 9.1231 ETH and the implied price is about $2,496 an ETH [10]. That is a mark from the moment of detection, so the dollar loss will drift with the market while the ETH count stays fixed [11].

ExVul put the method in one sentence: "No flash loan or AMM manipulation was involved." [4] We think the delegation framing holds on the evidence so far, and we can see two ways it could turn out incomplete.

The first is that the account is wrong in detail. It is one security firm's alert relayed by two outlets. Cryptotimes reported that the losses and the transaction sequence had not been independently confirmed against the full transaction record, because the alert's Etherscan link carried a shortened hash [13]. Crypto.news printed a full transaction hash [14], so a check against the chain is at least possible.

The second is that the signature was the last step of a theft that began elsewhere. When attackers drained WLFI token wallets with EIP-7702 in September 2025, SlowMist founder Yu Xian said they were using malicious delegations to seize assets from compromised wallets [8]. Neither report says how the sven.eth owner came to sign. That matters for the remedy too: only the original key can replace or reset the delegation, and only if that key remains secure [6]. If it was taken, the alert's advice to move the remaining assets to a newly secured wallet is the only step that works [7].

A transaction record showing the key was compromised before the authorization was signed would turn this from a delegation story into a key-management story. Short of that, we would go with ExVul: the theft needed a signature, and the contracts it touched needed no flaw [3].

What to watch

  • Whether the delegation on the sven.eth address is cleared or replaced after block 26,188,153, which only the original key can do.
  • Whether ExVul or another firm publishes transaction-level confirmation using a complete hash, since cryptotimes said the alert's own link was shortened.
  • Whether anyone establishes how the owner came to sign: a deceived signer and a stolen key lead to different conclusions.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence45
Adoption
Not scored
Hype gap−5
Incentives
Not scored
Confidence50
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The attacker submitted a sponsored type-4 transaction containing an EIP-7702 authorization signed by the victim; the attacker paid the fee, and the wallet owner did not need to fund or broadcast the transaction that activated the delegation.

    Reported Supported Source: ExVul, as reported by crypto.newsView cited source
  2. [2]

    The attacker-controlled code contained a fixed address authorized to operate the wallet; the controller invoked the PodMining.claim() function, transferred the resulting TAPEETH rewards and withdrew the wallet's ETH balance.

    Reported Supported Source: ExVul, as reported by crypto.newsView cited source
  3. [3]

    ExVul attributed the theft to malicious wallet authorization, not to a vulnerability in PodMining or TAPEETH.

    Reported Supported Source: ExVul, as reported by crypto.newsView cited source
  4. [4]

    ExVul said: "No flash loan or AMM manipulation was involved."

    Reported Supported Source: ExVul, as reported by crypto.newsView cited source
  5. [5]

    The security alert states that the malicious delegation remained active at Ethereum block 26,188,153, even after the reported theft.

    Reported Supported Source: ExVul alert, as reported by cryptotimes.ioView cited source
  6. [6]

    EIP-7702 delegation is not automatically removed when the establishing transaction finishes, so new funds deposited into an account with malicious delegated code could become accessible to the attacker; the original wallet's private key can authorize a replacement or reset of the delegation, provided it remains secure.

    Reported Supported Source: cryptotimes.ioView cited source
  7. [7]

    For the affected sven.eth wallet, the alert recommends avoiding new deposits, clearing or replacing the malicious delegation and moving any remaining assets to a newly secured wallet; the delegation's status as of publication has not been independently verified.

    Reported Supported Source: ExVul alert, as reported by cryptotimes.ioView cited source
  8. [8]

    In September 2025, hackers used EIP-7702 to drain World Liberty Financial (WLFI) token wallets; SlowMist founder Yu Xian said attackers were using malicious delegations to seize assets from compromised wallets when tokens became available.

    Reported Supported Source: cryptotimes.io, citing SlowMist founder Yu XianView cited source
  9. [9]

    Type-4 transactions are a transaction format introduced through EIP-7702 as part of Ethereum's Pectra upgrade in May 2025.

    Reported Supported Source: cryptotimes.ioView cited source
  10. [10]

    The ETH valuation implies a price of about $2,496 per ETH at detection.

    Derived Supported
  11. [11]

    Security firm ExVul reported that a wallet associated with sven.eth lost 9.1231 ETH, valued at approximately $22,770 at detection, after an attacker used a malicious EIP-7702 authorization to gain control of the account.

    Reported Contested Source: ExVul, as reported by crypto.newsView cited source
  12. [12]

    The wallet also lost 1.69271471 TAPEETH tokens; ExVul did not provide a separate dollar valuation for the TAPEETH tokens.

    Reported Contested Source: ExVul, as reported by crypto.newsView cited source
  13. [13]

    Cryptotimes reported that the losses and transaction sequence had not yet been independently confirmed against the full transaction record, and that the alert's Etherscan link contains a shortened transaction hash, preventing a conclusive transaction-level verification.

    Reported Contested Source: cryptotimes.ioView cited source
  14. [14]

    Crypto.news listed the transaction hash as 0x36e0d1491c14e3d8e50bc70d73675b89d2d4712814d16f808f957c84fde820ee and linked it to a sponsored type-4 Ethereum transaction.

    Reported Contested Source: ExVul, as reported by crypto.newsView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. crypto.news

    1 article · October 14, 2026

    Ethereum user loses $22K in EIP-7702 wallet attack
  2. cryptotimes.io

    1 article · October 13, 2026

    Ethereum Wallet Loses $22.7K in EIP-7702 Delegation Attack

Topics and entities

Topics

  • Crypto hacks and exploits
  • Crypto Wallet Security Features
  • EIP-7702 account delegation

Entities