Ethereum's programmable accounts are now live and operational, driven by ERC-4337 and EIP-7702. The upgrade lets regular wallets act like smart contracts — but a new study from USENIX Security 2026 found 924 malicious contract accounts, over 10 million accounts exposed, and at least $2.3 million in direct losses across seven EIP-7702-capable chains. The timing isn't great for an industry pushing institutions toward these accounts.
What the USENIX study found
Researchers identified that roughly 63% of EIP-7702 authorization transactions were linked to malicious activity targeting externally owned accounts (EOAs). The study covered seven chains that support the new standard. Attackers are already exploiting 7702-style delegated logic to route approvals, move funds via sponsored gas, or set permissive session rules. That's a lot of exposure for a feature that just went live.
How the attacks work
EIP-7702 allows EOAs to temporarily delegate to contract logic for a single transaction, enabled by the Pectra upgrade. Attackers abuse that delegation to gain control over approvals and session keys. They also use paymasters — the gas-sponsoring infrastructure from ERC-4337 — to cover transaction costs while siphoning funds. The new attack surface includes buggy validation logic, over-trusting paymasters, and phishing traps that trick users into signing malicious delegations.
What builders should do now
Builders should adopt WebAuthn/passkeys, session keys with granular scopes, paymasters for gas abstraction, and on-chain validation policies. The recommendation is to support both 7702-enabled EOAs and full 4337 smart accounts, auto-detecting capabilities to guide users. CoinDesk's Crypto for Advisors advised money managers to move beyond legacy EOAs and adopt programmable smart accounts as an automated defense layer against modern fraud. That advice comes with a caveat: the new tools need careful implementation.
Institutional adoption picks up
Telcoin launched regulated on-chain bank accounts for US users, tied to a bank-issued eUSD stablecoin, with merchant and institutional accounts forthcoming. Circle highlighted EIP-7702 for gasless and batched USDC payments, allowing EOAs to use smart logic for fee sponsorship. Institutional adoption is driving enterprise wallets toward programmable accounts for automated fraud defense. But the USENIX findings show that automation cuts both ways — attackers are automating too.
The next step for the ecosystem is hardening validation logic and paymaster policies. Builders have the tools, but the clock is ticking as more value flows into these accounts.
