Worked example · 2025-05

EIP-7702 CrimeEnjoyor delegation-phishing cohort — Ethereum mainnet — 2025-05 onward

Loss: approximately $12M+ extracted across 15,000+ wallets through the 2025-05–2025-12 window from EIP-7702 delegation-phishing campaigns; three high-net-worth victims accounted for nearly half the cumulative loss. Wintermute / GoPlus Security telemetry observed 450,000+ wallets with active EIP-7702 delegations to malicious contract families, of which the dominant cluster ("CrimeEnjoyor" — Wintermute's tag for a single ~120-byte contract whose bytecode is copy-pasted across the majority of malicious delegations on-chain) accounted for >80% of malicious-delegation share at peak. The realised on-chain extraction is bounded by the residual ETH balance at compromised EOAs at the moment of delegation activation; the addressable cohort is much larger than the realised extraction, with Wintermute reporting CrimeEnjoyor sweepers spending only ~2.88 ETH to register ~79,000 delegations against typically near-zero residual balances. The outsize realised losses come from the small subset of delegated EOAs that held material balances at activation time — including a single 2025-08-24 victim who lost ~$1.54M (wstETH, cbBTC, plus several additional staked-ETH and ERC-20 positions) after signing a single EIP-7702 batch transaction sourced from a fake DeFi-frontend lure that mimicked Uniswap.
Recovery: none of material consequence. Compromised EOAs whose authority is delegated to attacker-controlled implementation logic become permanently sweepable for the lifetime of the delegation — every subsequent inbound deposit can be auto-routed by the delegator's bytecode to attacker-controlled receiving infrastructure, including Relay Protocol cross-chain hops to consolidate proceeds on Ethereum mainnet. EIP-7702 includes a re-delegation primitive (the EOA can re-sign a new authorization tuple to a benign delegator address or to a "no delegate" zero-address sentinel, revoking the malicious one), but uptake is gated by user awareness and by the same wallet-UX surfaces that originally authorised the malicious delegation. Wintermute, GoPlus, MetaMask, and several wallet vendors have shipped CrimeEnjoyor-detection tooling and public dashboards (including the Wintermute Dune dashboard, MetaMask's pre-signing delegation warnings, and the dev-community on-chain detection regex pattern); SlowMist, Cyfrin, ThreeSigma, and Hacken have published forensic post-mortems. There is no public DOJ / civil-forfeiture action; the realistic recovery posture for the cohort is permanent.
OAK Techniques observed: OAK-T13 (Account Abstraction Attacks) at the Tactic level, broadly construed — EIP-7702 is the Pectra-upgrade primitive that converts a vanilla EOA into a smart-account-equivalent execution surface via a single signed authorisation tuple, and the delegation-phishing class is the dominant 2025-2026 attack realisation of that surface. The case does not map cleanly to any v0.1 T13 sub-Technique (T13.001 paymaster, T13.002 bundler MEV, T13.003 session-key hijacking) because EIP-7702 delegation is structurally distinct from each — the authority artefact is a per-EOA set-code authorisation that converts the EOA into a delegator-pointed execution context, not a paymaster-sponsored gas flow, not a bundler-ordered UserOp, and not a smart-account-issued session key. OAK-T4.001 (Permit2 Authority Misuse) is the closest existing-Technique analogue — both involve a victim signing a single approval-equivalent artefact whose downstream effect exceeds the victim's intent — but the EIP-7702 artefact is structurally broader: a Permit2 signature delegates spending authority over specific tokens, whereas an EIP-7702 authorisation delegates execution authority over the entire account to attacker-supplied bytecode. OAK-T7.001 chains downstream as proceeds are consolidated through Relay Protocol and standard EVM mixing rails. The case is the canonical anchor for OAK-T13.004 — EIP-7702 Delegation Abuse, the sub-Technique covering the persistent-execution-authority surface that EIP-7702 introduces.
Attribution: inferred-strong at the cohort-cluster level; pseudonymous at the named-individual level. Wintermute's CrimeEnjoyor tagging is supported by GoPlus Security on-chain telemetry showing >97% of malicious EIP-7702 delegations share identical bytecode lineage, indicating a small operator set centrally distributing the sweeper template across affiliate-deployed delegator instances. SlowMist publicly attributed the 2025-05-24 $146K MetaMask-delegated-wallet drain to Inferno Drainer by infrastructure overlap with the prior Inferno Drainer cohort (see examples/2024-10-inferno-drainer-handover.md for the broader handover-era cohort). The 2025-08-24 $1.54M single-victim drain was confirmed by SlowMist founder Cao Yun via on-chain analysis but no operator-cluster attribution was published. The CrimeEnjoyor cluster as a whole has not been linked to a specific named-individual or state-actor cohort by any forensic provider. The DEV-community on-chain analyst write-up reports cross-cluster correlation showing that some CrimeEnjoyor-deploying addresses overlap with prior 2024 wallet-drainer affiliate-marketplace infrastructure, supporting a drainer-as-a-service operating model rather than a single high-resourced operator. Contributors should treat the cohort as inferred-strong-cluster (multiple converging forensic signals across Wintermute, GoPlus, SlowMist, ThreeSigma, Cyfrin) but should not conflate with confirmed-attribution status.
Key teaching point: EIP-7702 introduces a persistent-execution-authority artefact whose blast radius substantially exceeds the EOA-era signed-authority artefacts (Permit2, ERC-20 approvals, NFT setApprovalForAll), and which the OAK v0.1 Tactic / Technique structure does not cover at sub-Technique granularity. The Pectra fork (Ethereum mainnet, 2025-05-07) shipped EIP-7702 as the path-of-least-resistance to "smart-wallet superpowers for vanilla EOAs"; within weeks Wintermute and GoPlus telemetry showed >90% of observed delegations were malicious. The class is structurally distinct from prior signed-authority phishing: a single signed authorisation tuple replaces the entire EOA's execution surface with attacker-controlled bytecode, which then executes on every subsequent inbound transaction — including, critically, on inbound transactions that the victim does not initiate (gifts, airdrops, staking-reward distributions). This makes the artefact the highest-blast-radius single-signature class in the EVM ecosystem at v0.1 freeze. Defender practice for the EIP-7702 era requires (a) wallet-UX surfacing of SetCodeTransactionType authorisations as a structurally distinct prompt class, not as a generic "approve this transaction" surface, (b) chain-agnostic-replay detection (EIP-7702 authorisation tuples can be replayed across chains absent chain-id binding by the delegator), and (c) cohort-level CrimeEnjoyor / malicious-delegator monitoring at the wallet, infrastructure, and exchange layers. The case is the canonical T13.004 anchor; cross-references to T4.001 (the closest analogue) preserve the structural-novelty framing.

Summary

EIP-7702 (set-code transaction type) shipped with Ethereum's Pectra hard fork on 2025-05-07. The primitive permits a vanilla externally-owned account (EOA) to sign a single authorisation tuple that registers a delegator contract address whose bytecode is then treated as the EOA's own code for purposes of execution — for every subsequent transaction the EOA participates in, the EVM routes execution through the delegator's bytecode rather than through the EOA's traditional opcode-empty execution model. The use-case rationale is strong: smart-wallet primitives (transaction batching, gas sponsorship, session keys, social recovery) become available to the existing EOA population without requiring wallet-key migration, and this lowers the friction barrier to account-abstraction adoption that ERC-4337 had not closed at scale.

Within weeks of Pectra activation, Wintermute and GoPlus Security on-chain telemetry showed that the dominant use of EIP-7702 was malicious. Wintermute's research, published 2025-06-02, tagged the dominant malicious-delegator family as CrimeEnjoyor — a single ~120-byte sweeper contract whose bytecode signature appeared (in identical or near-identical form) on >80% of observed EIP-7702 delegations. GoPlus reported >90% of delegations were linked to malicious contracts. The arXiv paper "EIP-7702 Phishing Attack" (Yan et al., 2025-12, eip7702phishingarxiv) presents the first empirical academic measurement: 150,000+ authorisation and execution events, 26,000+ delegated addresses, and the canonical taxonomy of three trigger pathways (user-driven, attacker-driven, protocol-triggered) by which delegated execution can be activated post-signing.

The economic shape of the CrimeEnjoyor cluster is structurally unusual. Wintermute's data shows the operator(s) spent ~2.88 ETH to register 79,000 delegations across compromised EOAs whose ETH balance was already near zero — these are EOAs whose private keys were compromised through prior conventional theft (info-stealer malware, leaked seed phrases in breach corpora, malware-extracted hardware-wallet exports), and whose remaining residual balance is too low to make individual sweep operations break even on gas. The CrimeEnjoyor delegation is a future-trapping primitive: by registering the delegation while gas is cheap, the operator captures any future deposit to the compromised EOA and routes it to attacker-controlled infrastructure. This is the structural reason the cohort's realised loss ($12M, 15,000+ wallets) substantially under-states the addressable surface (450,000+ delegated wallets observed by Wintermute / GoPlus): most compromised EOAs hold near-zero residual balance and the attacker is paying for option-value optionality, not realised extraction.

Two non-CrimeEnjoyor incidents anchor the realised-loss tail. 2025-05-24 — Inferno Drainer affiliate compromised a MetaMask-delegated EOA via a fake DeFi-frontend signing prompt and drained ~$146K in ETH and ERC-20 tokens (SlowMist forensic disclosure). The MetaMask delegator had been authorised by the user under one consent context (the user believed they were upgrading to MetaMask's smart-account features) and was then weaponised by Inferno Drainer's batch-transaction execute() call, which silently executed multiple token transfers in a single user-authorised invocation. 2025-08-24 — a single high-net-worth user lost ~$1.54M after signing an EIP-7702 batch transaction sourced from a fake-Uniswap phishing UI; SlowMist confirmed the loss and published the on-chain trace. The victim's portfolio of wstETH, cbBTC, and several additional staked-ETH positions was drained in a single contract call. This single-victim case is the largest disclosed EIP-7702 phishing loss at v0.1 freeze and the canonical worked example for how the delegation primitive's blast radius interacts with high-balance portfolios.

For OAK's purposes the cohort is the leading 2025–2026 worked example of an account-abstraction-class attack surface that the v0.1 T13 sub-Technique structure does not cover at sub-Technique granularity. EIP-7702 is mechanically distinct from ERC-4337 — there is no UserOperation, no EntryPoint, no bundler, no paymaster — but it is the same Tactic in OAK's framing because the load-bearing primitive is the conversion of an EOA's static-code execution model into a smart-account-equivalent dynamic-code execution model under a signed-authority artefact. The case is the canonical T13.004 (EIP-7702 Delegation Abuse) anchor covering the persistent-execution-authority surface; cross-references to T4.001 (Permit2-class signed-authority phishing, the closest analogue) preserve the structural-novelty framing.

Timeline (UTC)

When	Event	OAK ref
2024-Q4–2025-Q1	EIP-7702 specification stabilises through Pectra-fork client implementations; security researchers (Cyfrin, ThreeSigma, OpenZeppelin) publish pre-fork advisories warning that the delegation primitive is structurally riskier than prior signed-authority artefacts because the authorised bytecode is arbitrary and persistent	(pre-fork warning cohort)
2025-05-07	Pectra hard fork activates on Ethereum mainnet; EIP-7702 set-code transaction type becomes available; first benign delegations (MetaMask smart-wallet upgrade flow, ZeroDev, Circle gasless-USDC integration) ship within days	(primitive deployment)
2025-05 (within first weeks)	First malicious delegations observed on-chain; Wintermute begins telemetry tracking of high-frequency delegator addresses with identical bytecode	(cohort onset)
2025-05-24	Inferno Drainer drains ~$146K from a MetaMask-delegated EOA via fake DeFi-frontend signing-prompt phishing; SlowMist publishes forensic disclosure	T13 (broadly construed) extraction; first publicly-named-cluster EIP-7702 incident
2025-06-02	Wintermute publishes the CrimeEnjoyor research note tagging the dominant malicious-delegator family by bytecode signature; reports >80% of observed delegations malicious; opens public Dune dashboard for ongoing cohort tracking	(cohort transparency anchor)
2025-Q2–Q3	Cohort scales: GoPlus Security reports >90% of delegations linked to malicious contracts; Hacken / Cyfrin / ThreeSigma publish defender-oriented analyses	(cohort scaling)
2025-08-24	$1.54M single-victim drain — high-net-worth user signs an EIP-7702 batch transaction sourced from a fake-Uniswap phishing UI; loses wstETH, cbBTC, and additional staked-ETH positions; SlowMist publishes on-chain trace	T13 (broadly construed) extraction; largest disclosed single-victim EIP-7702 loss at v0.1
2025-Q3–Q4	Cohort cumulative impact passes $12M / 15,000+ wallets per Wintermute and GoPlus aggregations; three high-net-worth victims account for ~half the cumulative realised loss	(cohort scaling)
2025-12	Yan et al. publish "EIP-7702 Phishing Attack" arXiv paper (`[eip7702phishingarxiv]`) — first academic empirical measurement of the cohort; 150,000+ authorisation and execution events, 26,000+ delegated addresses	(academic taxonomy anchor)
2026-01 onward	MetaMask, Trust Wallet, Rabby, Frame ship pre-signing delegation-warning UX as a distinct prompt class; Wintermute's Dune dashboard becomes a community-standard cohort-tracking surface	(defender response)
2026-04	EIP-7702 delegation-flaw incident drains 1,988 QNT (~$60K equivalent) from a Quant-network ETH pool via delegation-abuse on a contract counterparty's EOA; cohort transitions from individual-user-victim to protocol-counterparty-victim phase	(cohort evolution)
Continuing	No public DOJ / civil-forfeiture action; CrimeEnjoyor cluster active; addressable surface (450,000+ delegated wallets) substantially exceeds realised extraction ($12M+) at v0.1 freeze	(recovery state)

What defenders observed

The delegation primitive's blast radius is structurally larger than any prior signed-authority artefact in the EVM ecosystem. Permit2 (T4.001) authorises an attacker to spend specified tokens up to specified amounts within a specified expiry; ERC-20 approve authorises spending of a specific token to a specific spender; NFT setApprovalForAll (T4.005) authorises transfer of an entire NFT collection to a specific operator. EIP-7702 authorises attacker-controlled bytecode to execute as the account itself on every subsequent transaction the EOA participates in, including inbound transactions the victim does not initiate. The blast-radius scaling is qualitative, not merely quantitative: a single signature converts the EOA into a smart-account whose authority logic is arbitrary attacker code. Defender practice for the EIP-7702 era cannot reuse the wallet-UX patterns that worked (partially) for T4-class phishing — the cognitive load required to evaluate "what does this delegator's bytecode do" is structurally higher than "what does this allowance amount mean," and wallet vendors who present the delegation prompt as a generic "approve transaction" are operationally surfacing a class of consent the user cannot reasonably evaluate.
The CrimeEnjoyor optionality model decouples cohort scale from realised loss. Wintermute's data shows the operator paid ~2.88 ETH to register ~79,000 delegations against typically near-zero-balance EOAs. The operator is acquiring option-value over the future state of those EOAs — every airdrop, gift, mistaken transfer, or returned-deposit lands in attacker hands. This makes traditional realised-loss aggregation a substantial under-estimate of the cohort's actual harm: the addressable surface (450,000+ delegated EOAs) is the appropriate quantification, not the realised-extraction sum. Defender practice for the cohort should treat delegated-EOA-set size as a first-class metric, alongside realised-extraction sum, and should weight the future-deposit-trapping risk explicitly when communicating user impact.
Chain-agnostic replay is a structural amplifier. The EIP-7702 authorisation tuple, when signed without chain-id binding (a permitted protocol mode for cross-chain compatibility), can be replayed against the same EOA on any chain that has activated EIP-7702. A user signing a delegation for a single-chain use-case can find the same delegation active on every EVM chain whose key derivation matches their EOA. Wintermute's research highlights this as one of the persistent structural risks of the primitive: defender practice should include cross-chain delegation-state monitoring for any EOA flagged on one chain.
Inferno Drainer's pivot to EIP-7702 is operational continuity, not novel capability. The 2025-05-24 incident is not Inferno Drainer's first appearance in the OAK corpus — see examples/2024-10-inferno-drainer-handover.md for the prior handover-era cohort. The pivot to EIP-7702 batch-transaction phishing is operationally continuous with the prior drainer-as-a-service architecture: the same affiliate-marketplace recruitment, the same fake-frontend lure infrastructure, the same proceeds-laundering rails — only the on-chain extraction primitive (delegation + batched execute() call) is new. This is the same operator-substrate-continuity pattern the OAK corpus documents repeatedly across drainer-class incidents (Pink Drainer → Inferno Drainer → CrimeEnjoyor-affiliate ecosystem). Defender practice should treat new on-chain primitives as deployment surfaces for existing operator clusters, not as evidence of new entrant cohorts, until cluster-level forensic evidence specifically supports the latter.
The defender response shape — wallet-UX warning + community detection regex + on-chain dashboard + academic empirical paper — landed within ~6 months of cohort onset. The EIP-7702 phishing cohort is one of the fastest-coordinated defender responses in the OAK 2024–2026 corpus: Wintermute's CrimeEnjoyor tag (2025-06-02), GoPlus delegation-state API (2025-Q2), MetaMask pre-signing warning (2025-Q4 onward), Yan et al. arXiv paper (2025-12), DEV-community detection regex (2025-Q3). Compared with the multi-year defender-response lag on T4.001 / Permit2 phishing (Inferno Drainer cohort matured for 2+ years before vendor-side wallet warnings shipped at scale), the EIP-7702 response timeline is materially faster. The defender lesson: when a high-blast-radius primitive ships at protocol level with substantial pre-fork-warning literature, the post-launch defender-coordination timeline can be compressed to months rather than years if the wallet vendor / forensic provider / academic ecosystems coordinate.
The realistic recovery posture is permanent. Compromised EOAs whose authority is delegated to attacker-controlled implementation logic remain sweepable for the lifetime of the delegation. Re-delegation to a benign address or to the zero-address sentinel is structurally available but is gated by the same wallet-UX surface that originally authorised the malicious delegation. There is no on-chain primitive analogous to the WalletConnect session-revocation surface; there is no equivalent of the Permit2 lockdown function for EIP-7702 delegations. Defender practice should accept the permanent-recovery posture as the realistic ceiling and concentrate effort on prevention (wallet-UX), detection (cohort dashboards), and exposure-mitigation (re-delegation UX) rather than on post-event recovery.

What this example tells contributors writing future Technique pages

OAK-T13.004 covers EIP-7702 delegation abuse as a structurally distinct primitive. The CrimeEnjoyor cohort is the canonical 2025–2026 worked example for T13.004 (EIP-7702 Delegation Abuse). The sub-Technique's scope: persistent-execution-authority delegation under EIP-7702 set-code transaction type, including (a) malicious-delegator phishing (CrimeEnjoyor cluster), (b) batch-transaction signing-prompt abuse (Inferno Drainer 2025-05-24 case), (c) chain-agnostic-replay amplification, and (d) future-deposit-trapping optionality. Distinct from T4.001 (Permit2-class signed-authority phishing) at the artefact level: Permit2 delegates token-spending authority within the EOA's execution model; EIP-7702 replaces the EOA's execution model entirely. Distinct from T13.003 (session-key hijacking) at the artefact level: session keys are smart-account-issued ephemeral signers; EIP-7702 delegations are EOA-issued persistent execution-context replacements. Contributors writing future T13.004 worked examples should treat the CrimeEnjoyor / Inferno-Drainer-pivot / $1.54M-single-victim trio as the canonical sub-pattern set.
The persistent-execution-authority class is a structurally novel artefact in the EVM ecosystem and warrants its own defender-mental-model. Pre-EIP-7702, every signed authority artefact in the EVM ecosystem (signatures, approvals, permits, NFT operator-authorisations, smart-account session-keys) was bounded — bounded in scope (which token? which spender? which collection?), bounded in time (expiry, nonce), bounded in target (which counterparty contract?). EIP-7702 delegation removes all four bounds simultaneously: the delegator's bytecode can execute arbitrary logic, persistently, against any future state of the EOA. Defender-mental-model literature should articulate this as a category-level shift, not as an incremental risk increase. Contributors writing the OAK Mitigations layer should consider a cross-cutting Mitigation entry covering wallet-UX-surfacing-of-execution-authority-class artefacts, with the EIP-7702 cohort as the leading 2025–2026 worked example.
Cohort-aggregated optionality value is a first-class metric distinct from realised-loss aggregation. The CrimeEnjoyor cluster paid ~2.88 ETH to acquire ~~79,000 future-deposit-trapping options. The realised-loss aggregation (~~$12M, 15,000+ wallets) under-states the cohort's actual harm shape — the option-portfolio sweeps will continue extracting from the addressable surface (450,000+ delegated EOAs) for the lifetime of those delegations, which absent active re-delegation is effectively permanent. OAK worked-example methodology should record both quantities explicitly when the artefact is option-shaped (T13.004 EIP-7702 delegations, T4.001 Permit2 large-allowance approvals, T11.002 supply-chain-installed wallet-extension malware) and should not conflate realised loss with cohort harm.
The defender-response timeline for high-blast-radius protocol primitives can be compressed to months when forensic-provider, wallet-vendor, and academic ecosystems coordinate from pre-launch. EIP-7702's defender-response timeline (cohort onset 2025-05, Wintermute tag 2025-06, MetaMask warnings 2025-Q4, academic paper 2025-12) is materially faster than T4.001 Permit2's defender response (cohort onset 2022, vendor warnings at scale 2024+). The structural difference: EIP-7702's pre-fork warning literature was substantial (Cyfrin / ThreeSigma / OpenZeppelin pre-Pectra advisories); the wallet-vendor ecosystem coordinated on the warning UX before mass adoption. Future high-blast-radius protocol primitives (cross-chain delegation, SSV-equivalent in liquid-restaking, AVS slashing-condition delegation) should default to this coordination shape as the operational baseline.
Inferred-strong cohort-cluster attribution is the appropriate v0.1 status for the CrimeEnjoyor cluster. The convergence across Wintermute (bytecode-signature clustering), GoPlus Security (delegation-state API), SlowMist (per-incident forensics for the 2025-05-24 and 2025-08-24 cases), ThreeSigma, and Cyfrin produces a multi-source signal that meets the inferred-strong threshold. Contributors should not treat the case as confirmed (no regulator / court / protocol-team-published-postmortem at v0.1) but should also not regress to pseudonymous simply because no named individual is in the public record. The convergent forensic-cluster signal is the appropriate evidence base.

Public references

[wintermute7702crimeenjoyor2025] — Wintermute research note tagging the CrimeEnjoyor delegator family; 2025-06-02; canonical bytecode-signature-cluster anchor for the cohort.
[coindeskcrimeenjoyor2025] — CoinDesk reporting on Wintermute's CrimeEnjoyor analysis, including the ~2.88 ETH / 79,000 delegations economics figure.
[goplus7702malicious2025] — GoPlus Security delegation-state telemetry showing >90% of EIP-7702 delegations linked to malicious contracts.
[slowmistinferno7702may2025] — SlowMist forensic disclosure of the 2025-05-24 Inferno Drainer MetaMask-delegated-EOA $146K drain.
[slowmist7702aug2025] — SlowMist on-chain trace of the 2025-08-24 $1.54M single-victim EIP-7702 batch-transaction phishing loss.
[cryptopolitan7702aug2025] — Cryptopolitan reporting on the $1.54M EIP-7702 phishing case including portfolio composition (wstETH, cbBTC, additional staked-ETH).
[eip7702phishingarxiv] — Yan et al., "EIP-7702 Phishing Attack," arXiv 2512.12174, 2025-12; first academic empirical measurement (150,000+ authorisation events, 26,000+ delegated addresses).
[devohmygodcrimeenjoyor2025] — DEV-community on-chain detection regex and 450,000+ delegated-wallets cohort framing.
[threesigma7702wallets2025] — ThreeSigma "Inside Wallet Drainers and EIP-7702 Exploits" defender analysis.
[hacken7702aa2025] — Hacken account-abstraction overview covering EIP-7702 risk surface in the post-Pectra era.
[cryptotimes7702quant2026] — CryptoTimes coverage of the 2026-04 EIP-7702 delegation-flaw drain of 1,988 QNT from a Quant-network pool.
[eip7702spec] — EIP-7702 specification (canonical reference for the set-code transaction type primitive).

Citations

[wintermute7702crimeenjoyor2025] — Wintermute research note; primary source for CrimeEnjoyor bytecode-signature cluster and ~2.88 ETH / ~79,000 delegations economics.
[coindeskcrimeenjoyor2025] — CoinDesk; primary public-press source for Wintermute's analysis.
[goplus7702malicious2025] — GoPlus Security; primary source for the >90%-malicious-delegations telemetry.
[slowmistinferno7702may2025] — SlowMist; primary source for the Inferno Drainer 2025-05-24 incident and cluster attribution.
[slowmist7702aug2025] — SlowMist; primary source for the 2025-08-24 $1.54M single-victim incident on-chain trace.
[cryptopolitan7702aug2025] — Cryptopolitan; secondary source for the 2025-08-24 case framing and victim portfolio composition.
[eip7702phishingarxiv] — arXiv 2512.12174; primary academic source for the empirical-measurement layer.
[devohmygodcrimeenjoyor2025] — DEV-community; secondary source for the 450,000+ delegated-wallets cohort framing.
[threesigma7702wallets2025] — ThreeSigma; secondary defender-oriented analysis source.
[hacken7702aa2025] — Hacken; secondary source for the AA / EIP-7702 surface framing.
[cryptotimes7702quant2026] — CryptoTimes; primary source for the 2026-04 Quant-network protocol-counterparty-victim incident.
[eip7702spec] — Ethereum Foundation; canonical reference for the set-code transaction-type primitive.

Discussion

The EIP-7702 CrimeEnjoyor cohort is OAK's canonical 2025–2026 worked example for the persistent-execution-authority delegation surface under the broad T13 (Account Abstraction Attacks) Tactic. The case sits adjacent to but operationally distinct from the v0.1 T13 sub-Techniques (T13.001 paymaster compromise, T13.002 bundler MEV, T13.003 session-key hijacking) — none of those sub-Techniques captures the EOA-resident delegation primitive that EIP-7702 introduces. The case argues for a v0.x T13.004 sub-Technique covering EIP-7702 delegation abuse, with this cohort as the anchor.

The cohort's structural framing — option-portfolio acquisition with cohort-scale dwarfing realised-extraction — is the analytically distinctive feature at the corpus level. The CrimeEnjoyor operator(s) acquired ~79,000 future-deposit-trapping options for ~2.88 ETH; the addressable cohort exceeds 450,000 delegated EOAs across the broader malicious-delegator ecosystem; the realised extraction ($12M+) reflects only the small subset of delegated EOAs holding material balances at activation time. This is the same option-portfolio shape the OAK corpus documents in T4.001 (Permit2 large-allowance phishing, where the realised loss is bounded by what was held at compromise time, not by the allowance ceiling) and in T11.002 (supply-chain-installed wallet-extension malware, where the realised loss across a 2,600-wallet cohort like Trust Wallet 2025-12 is bounded by per-wallet residual balance) — but it scales further under EIP-7702 because the delegation persists beyond the moment of compromise and traps every subsequent inbound transaction.

The Inferno Drainer pivot to EIP-7702 is operationally continuous with the prior drainer-as-a-service architecture documented at examples/2024-10-inferno-drainer-handover.md. The same affiliate marketplace, the same fake-frontend lure infrastructure, the same proceeds-laundering rails — only the on-chain extraction primitive is new. This is the OAK corpus's broadest pattern across drainer-class incidents: new on-chain primitives are deployment surfaces for existing operator clusters, not evidence of new entrant cohorts. Contributors writing future T13.004 worked examples should expect to encounter the same operator-substrate-continuity at the cluster level, even when the on-chain artefact class is new.

The single-victim $1.54M (2025-08-24) incident anchors the realised-loss tail in the cohort. The victim signed an EIP-7702 batch transaction sourced from a fake-Uniswap phishing UI; the batch executed multiple token transfers in a single user-authorised invocation across wstETH, cbBTC, and additional staked-ETH positions. The case is operationally continuous with the broader signed-authority-phishing class (T4.001) but its blast radius is structurally larger: the signed authorisation replaced the EOA's execution model with attacker-controlled bytecode, not merely authorised a token transfer. Defender-mental-model literature should preserve this distinction explicitly.

The defender-response timeline is one of the fastest-coordinated in the OAK 2024–2026 corpus. Wintermute's CrimeEnjoyor tagging (2025-06-02, less than a month after Pectra activation), GoPlus delegation-state API (2025-Q2), MetaMask pre-signing warning UX (2025-Q4 onward), Yan et al. arXiv academic paper (2025-12), DEV-community detection regex (2025-Q3) — together this constitutes a coordinated defender-response shape that compares favourably with the multi-year vendor-warning lag on T4.001 Permit2 phishing. The structural difference is the substantial pre-fork warning literature (Cyfrin / ThreeSigma / OpenZeppelin pre-Pectra advisories) that primed wallet-vendor coordination from before mass adoption. Future high-blast-radius protocol-level primitives should default to this coordination shape.

For OAK's broader credibility, including the EIP-7702 CrimeEnjoyor cohort in v0.1 closes a structural gap: T13's sub-Technique structure at v0.1 covers ERC-4337 paymaster / bundler / session-key surfaces but does not cover the post-Pectra EOA-delegation surface that became the dominant 2025–2026 account-abstraction attack class. The case is the leading worked example arguing for a v0.x T13.004 (EIP-7702 Delegation Abuse) sub-Technique, and it documents a structurally novel attack-surface class whose blast-radius shape exceeds any prior EVM signed-authority artefact at v0.1 freeze.