Attackers exploited Ethereum’s EIP-7702 feature to authorize smart contracts that automatically transfer ETH from wallets with stolen private keys to attacker-controlled addresses.

Quotes that support claims

Hackers are abusing the new EIP-7702 feature introduced in the Ethereum Pectra Upgrade to automate the transfer of ETH from wallets with stolen private keys. According to blockchain security researchers, attackers are using EIP-7702 to deploy smart contracts that drain funds without manual action.

The malicious contracts exploit a feature introduced in Ethereum’s Pectra upgrade, called Ethereum Improvement Proposal-7702 (EIP-7702), that allows users to temporarily delegate control of their wallets to smart contracts.