EIP-7702 Phishing: Fake Wallet Upgrades, Fake Airdrops and Signature Requests You Should Never Sign
Fake wallet upgrades, fake airdrops and odd signature requests can trick you into an EIP-7702 delegation. Learn the warning signs and what never to sign.
Phishing in crypto is not new, but each technical change gives scammers a new script. EIP-7702 lets a normal wallet address use a smart contract's code after the owner signs an authorization. If you are not familiar with the basics, read our explainer on what EIP-7702 is and how it differs from a token approval. This article focuses on how fraudsters can try to misuse it and how to protect yourself.
Why delegation is attractive to scammers
Ethereum.org warns that delegating to a malicious contract can let an attacker take control of funds. A delegation is also broader than a token approval, because it affects how the whole account behaves, not only one token.
Another detail matters for phishing. According to the Ethereum Foundation, the authorization is a signed message that another party can submit. That means you may not see a normal-looking payment screen or pay any fee yourself, and "nothing was charged" is not proof that nothing happened.
Common pretexts
Scammers wrap the request in a story. Typical examples include:
- "Upgrade your wallet." A site or message claims your wallet must be "activated", "upgraded" or "migrated" to a new Ethereum standard before a deadline.
- Fake airdrops. A page offers free tokens and asks you to "verify eligibility" with a signature.
- Fake support. Someone pretending to be exchange or wallet support asks you to sign to "secure" or "restore" your account.
- Fake security tools. A page claims to "revoke" or "protect" your wallet from the newest attack, and the signature it requests is the attack itself.
- Cloned dApps. A copy of a real site, reached through a sponsored ad or a lookalike address, shows a familiar interface with a different request behind it.
These patterns are similar to the ones described in our article on wallet drainer links in memecoin communities. Only the format of the request changes.
How to recognise a delegation request
Wallet screens vary and change often, so check your wallet's current behaviour. Warning signs include:
- Words such as "authorization", "delegate", "smart account", "set code" or "upgrade account", especially when you did not start an account setting yourself.
- A request that shows a contract address you do not recognise.
- A chain ID of 0 or "all chains". Ethereum.org explains that this makes a delegation apply across networks.
- A request that appears the moment you connect, before you did anything.
- A message you cannot read in plain language, or a wallet that does not show what the signature does.
If your wallet shows you a raw signature request with no explanation, stop. Not understanding it is reason enough not to sign.
What never to sign
- Anything that arrived through a direct message, a comment, an ad or an email, unless you can confirm it independently.
- Any request tied to a deadline, a reward or a threat of losing access.
- Any authorization to a contract you cannot identify from official sources.
- Any request from a site you reached through a link rather than a bookmark you set yourself.
If you genuinely want a smart-account feature, start it from the settings of your own wallet app, and compare the contract address with that wallet provider's official documentation. Our article on wallet safety when trading new memecoins covers general signing habits.
What if you already signed something suspicious?
Act quickly and calmly.
- Stop using the wallet and do not sign anything else.
- Check whether a delegation is active. Our guide on how to check and revoke an EIP-7702 delegation explains how.
- Move assets to a new wallet if your key or recovery phrase could be exposed.
- Review and revoke token approvals separately.
- Report the site to your wallet provider and the platform where you saw the link.
Why this matters beyond ordinary users
Delegations were also part of reporting on a major exchange incident in October 2026. According to CoinDesk, Binance's co-CEO said attackers used EIP-7702 delegation against a hot wallet, and the full sequence of events had not been determined. See our summary of the Binance security incident. Read Binance's official updates for the current facts. The standard itself is a legitimate feature, so the lesson is about who is allowed to sign and what exactly is signed.
Before you interact with an unknown address or contract, you can create or open a ScamSonnar account with Google or a magic link and check it first.
Phishing methods change within hours. Verify every request yourself in your wallet's official documentation before signing anything.
This article is for general information only and is not financial advice.