EIP-7702 Delegation Contract Exploit Hack

On October 3, 2025, an Externally Owned Account (EOA) lost approximately $336,000 in USDT on BNB Chain due to an insecure EIP-7702 delegation contract. This appears to be one of the first documented exploits leveraging the EIP-7702 standard, where a vulnerable delegation contract allowed attackers to drain funds through an unprotected public function.

The victim's EOA address delegated control to a vulnerable smart contract through EIP-7702, a new Ethereum standard that allows EOAs to temporarily function like smart contract wallets. The delegation contract contained a critical flaw: a public function called pancakeV3SwapCallback() that anyone could call without proper access controls. This "blind trust" design allowed the attacker to invoke this function and transfer the victim's USDT tokens out of the account.

The vulnerability highlights a new attack vector introduced by EIP-7702 adoption, where users may focus on traditional smart contract security but overlook the risks of delegation contracts. Unlike typical phishing attacks that steal private keys, this exploit leveraged legitimate delegation functionality with an insecure implementation, allowing unauthorized asset transfers without compromising the victim's actual private keys.

Exploit Transaction:

0x33242482…9c1668

Delegation Setup Transaction:

0xeda3c6bf…645bc5