The EIP-7702 sweeper behind the sven.eth theft: 120 wallets, not one, and the 9 ETH went back nine minutes later

EIP-7702, part of Ethereum’s Pectra upgrade, lets an ordinary wallet sign an authorization that makes it run a contract’s code. Whoever holds that signature can submit it in a “type-4” transaction and act through the wallet. Security researchers have warned since May 2025 that most such delegations on mainnet point to sweeper contracts: code that empties wallets whose keys have leaked.

On 14 October [crypto.news](https://crypto.news/ethereum-user-loses-22k-in-eip-7702-wallet-attack/), citing the security firm ExVul, reported that sven.eth (0xd8ba9E5886B7000BACe2C9dbdd0BE98Ac77D4A28) had lost 9.1231 ETH, about $22,770, and 1.69 TAPEETH tokens. The attacker was 0x9208097C007be15e28b20e94e66870A3f9F820bc, the contract 0x0366B55F948a688888Ca6E029Ad0831F6EC260D1; the delegated code claimed the wallet’s rewards from a staking contract and sent them, with its ETH, to the attacker. The report said no reimbursement had been identified and did not say how the signature was obtained.

The attacker’s wallet received 0.05 ETH for gas from 0x4B8009b9Aff952bAd6d2bb9E07BAeC432e8d5a9C at 23:22 UTC on 13 October. Eight minutes later it deployed the delegate contract itself, so the contract is the attacker’s and not a public tool. It then sent 122 type-4 transactions, the last at 15:01 UTC on 14 October. Between them they carry signed delegations from 120 different wallets, every one pointing at 0x0366B55F948a688888Ca6E029Ad0831F6EC260D1. Each delegation was signed for the wallet’s current transaction count, the value it must have at the moment of use.

ETH arrived from 114 of those wallets, 12.66 ETH in total, and tokens from 32 of them. The tokens were mostly memecoins worth little; the attacker sold the ones it could through 1inch and its own contract. Besides sven.eth, the largest amounts were 1.2058 ETH and 1.0830 ETH from two wallets swept on the afternoon of 14 October. The rest were small: most wallets lost a few hundredths of an ETH.

The wallets have little in common: memecoin traders using trading-bot routers and Uniswap, wallets that deposit through the Relay bridge, wallets that deploy contracts. That pattern fits keys leaked from many different places rather than one hacked service. Today every one of the 120 holds less than 0.01 ETH.

sven.eth was swept at 23:43:59 UTC on 13 October; the attacker’s balance went from 0.37 to 9.49 ETH. It swept 17 more wallets over the next eight minutes. At 23:52:59 it sent 9.5769 ETH to sven.eth, a plain transfer with no message. That was its whole balance: it was left with 0.00004 ETH. sven.eth got back 0.45 ETH more than it lost; the extra was money the attacker had swept from other wallets that night.

The chain does not say why. A sweeper returning money is unusual; it may have been a mistake in the attacker’s script or a deliberate choice. What the chain does show is that sven.eth kept trading as normal, removed the delegation at 04:14 UTC on 14 October, and today holds 3.88 ETH. The press figure of $22,770 lost is not the final position of that wallet.

After the refund the attacker started again from 0.02 ETH and kept sweeping. At 00:44 UTC on 14 October it sent 0.3268 ETH back to the funding wallet. The funding wallet trades memecoins actively and moves money out through the Relay bridge.

At 17:02 UTC on 14 October the attacker sent 3.3188 ETH to 0x3895F8f98e90d2D4240693e308d892770EE4378A, a fresh address that forwarded it 36 seconds later to 0x487cab40f6D11a278fa7C442C6741Eabe44eAb5d, a Binance deposit address, and was never used again. The attacker’s wallet is left with 0.001 ETH. Binance can see which account that deposit belongs to.

None of the attacker’s addresses were marked in our database. On 15 October we added the attacker wallet, its delegate contract, the one-use forwarder and the funding wallet under one incident; the funding wallet with lower confidence, because it paid the first gas and took ETH back but did not sweep anyone itself. We did not mark the 120 wallets that were swept, the Binance deposit address, Relay or any exchange.

If your wallet is among the 120, its key or a signature made with it is in someone else’s hands: move what is left to a new wallet created on a clean device. To check an address yourself, use the address check.

It does not say who the attacker is, how the keys or signatures were obtained, or why the 9.58 ETH was sent back. It does not say that sven.eth, the other swept wallets, Binance, Relay or any trading tool did anything wrong. The original loss report is ExVul’s. The other 119 wallets, the refund, the cash-out route and the state of the wallets on 15 October are ours.