EIP-7702 · wallet security · explainer

What is an EIP-7702 sweeper, and is one on your wallet?

An EIP-7702 sweeper is a small smart contract that an attacker attaches to a wallet whose private key they already have. Once attached, anything that lands in the wallet is forwarded to the attacker, usually within the same block. This page explains how it works, how to check your address in a few seconds, and what to do if you find one.

Check an address free →

On this page

What EIP-7702 changed
How a 7702 sweeper works
How to check a wallet
What to do if you find one
FAQ

What EIP-7702 changed

EIP-7702 shipped in Ethereum's Pectra upgrade on 7 May 2025 and has since been adopted by Base, BNB Chain, Arbitrum, Optimism, Polygon, Gnosis, Unichain and other EVM chains. It lets a normal wallet (an EOA) sign an authorization that points the account at an existing contract. After that, the account's code is a 23-byte delegation designator: the prefix 0xef0100 followed by the 20-byte address of the delegate contract. Calls to the wallet then run the delegate's code, while the address and key stay the same.

That is what makes batching, gas sponsorship and passkey-style wallets possible. It also means one signature can permanently change how a wallet behaves until the owner signs a new authorization.

How a 7702 sweeper works

Before 7702, a thief holding a leaked key had to run a bot that watched the address and raced the owner with a transfer every time funds arrived. With 7702 the thief signs one authorization that delegates the wallet to a contract whose fallback/receive code forwards incoming ETH (and sometimes tokens) to the attacker. The wallet now sweeps itself.

Leaked-key sweepers. Keys leak through malware, seed phrases typed into phishing sites, cloud backups or copied test keys. The owner usually notices only when deposits vanish.
Phishing authorizations. Phishing sites have also asked users to sign 7702 batch transactions that approve and move tokens in one step.

Scale: within weeks of Pectra, Wintermute Research reported that over 97% of EIP-7702 delegations pointed to contracts with the same copy-pasted sweeper bytecode, which they nicknamed "CrimeEnjoyor". A 2026 USENIX Security study across seven chains found 924 malicious contract accounts and over $2.3 million in losses linked to 7702 abuse.

How to check a wallet

Fast way: paste the address into the free 7702 Sweeper Check. It reads the account code on 8 chains and tells you whether a delegation is set, and to which contract.
By hand: call eth_getCode(address, "latest") on each chain. 0x means no delegation. A result starting with 0xef0100 means the wallet is delegated; the next 40 hex characters are the delegate contract.
Judge the delegate. A delegation to a known wallet implementation (for example the one your wallet app installed when you enabled smart-account features) is normal. A delegation you never set, to an unverified contract with tiny bytecode that forwards value, is the sweeper pattern. The paid report checks delegate bytecode heuristics and source verification for 1-20 addresses and costs 0.01 USDC (x402 on Base).

Read-only: checking an address never needs a signature, a wallet connection or a seed phrase. Anyone who asks for one to "scan" or "recover" your wallet is running a scam.

What to do if you find a sweeper

Assume the key is compromised. A sweeper delegation can only be set with your private key, so someone has it. Revoking the delegation does not take the key back.
Stop sending funds to that address, including gas. Gas you send is usually swept at once.
Create a new wallet on a clean device with a new seed phrase, and move whatever is still movable (tokens, NFTs, staked positions) there. Sweepers often forward only ETH, so some assets may still be recoverable, but bots compete for them.
Revoke token approvals on the old address with a reputable approvals tool once you can pay gas safely.
Ignore "recovery" offers in DMs. Fake recovery services are a common follow-up scam.

If funds were stolen, report it to your exchange (if deposits came from one) and to local law enforcement. Keep the transaction hashes.

FAQ

What is an EIP-7702 sweeper?

A sweeper is a smart contract that an attacker delegates a compromised wallet to using EIP-7702. Its code forwards any incoming ETH or tokens to the attacker, so the wallet drains itself as soon as funds arrive.

How do I know if my wallet has a 7702 delegation?

Call eth_getCode on your address. If the result starts with 0xef0100, the wallet is delegated and the next 20 bytes are the delegate contract. The free 7702 Sweeper Check does this on 8 EVM chains at once.

Can I remove a 7702 sweeper?

You can sign a new authorization that delegates to the zero address, but the attacker still has your key and can set it again. The safe fix is to move remaining assets to a new wallet made on a clean device.

Is every EIP-7702 delegation malicious?

No. Wallets use 7702 for batching, gas sponsorship and smart-account features. A delegation you set yourself through your wallet app to its known implementation is normal. A delegation you never set is a red flag.

Which chains support EIP-7702?

Ethereum mainnet since the Pectra upgrade on 7 May 2025, plus many EVM chains including Base, BNB Chain, Arbitrum, Optimism, Polygon, Gnosis and Unichain.