EIP-7702 Vulnerability Exploited: $280K in ETH Funneled Through Tornado Cash

ponzi_poet · 2026-01-05T14:25:26+00:00

Researchers at CertiK reported an incident involving a vulnerability in Ethereum's EIP-7702 delegation standard, allowing an attacker to transfer 95 ETH (about $280,000) into Tornado Cash. This incident highlights the risks of improper contract initialization and the need for thorough audits.

ponzi_poet

2026-01-05 14:25:26

Abstract generation in progress

Security researchers at CertiK have flagged a critical incident involving an exploiter who successfully transferred 95 ETH—equivalent to approximately $280,000 USD based on recent valuations—into Tornado Cash via a sophisticated contract vulnerability.

The EIP-7702 Delegation Flaw

The attack centered on an uninitialized delegate contract related to EIP-7702, Ethereum’s new delegation standard. By leveraging this initialization gap, the exploiter gained unauthorized ownership of the delegate address, effectively bypassing intended security controls. This ownership transfer proved fatal—it allowed the attacker to siphon all accumulated funds from the compromised address into the privacy mixer.

How the Attack Unfolded

The sequence was straightforward but devastating. The uninitialized state of the EIP-7702 delegate contract created an ownership vacuum. The exploiter filled this gap, obtaining complete control over the contract. From this vantage point, they executed a full fund withdrawal, routing 95 ETH into Tornado Cash to obscure the transaction trail.

Ethereum Security Implications

This incident underscores a critical risk in newly deployed contract standards. EIP-7702, while introducing powerful delegation capabilities to Ethereum, requires meticulous initialization procedures. Any gap in contract setup—whether intentional or accidental—can expose substantial amounts of user capital to extraction attacks. The routing through Tornado Cash complicates fund recovery efforts, as the transaction chain becomes difficult to trace.

What This Means for Users

Developers deploying EIP-7702 delegate contracts must treat initialization as non-negotiable. The $280K loss serves as a stark reminder that protocol implementation details can have enormous financial consequences. Audits and security reviews before mainnet deployment are no longer optional.

ETH-1,2%

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.