Ethereum

Uniswap

The recent Ethereum Pectra upgrade—which introduced smart wallets, validator limit increase and multiple other upgrades to the network— has inadvertently exposed user wallets to a severe “auto-drain” risk. The research, carried out by the Wintemute team, discloses that 97% of these upgrade delegations are tied to malicious “sweeper” contracts.&nbsp;
The upgrade, which <a href="https://www.cryptotimes.io/2025/05/07/ethereum-pectra-goes-live-with-l2-boost-gasless-transactions/" target="_blank" rel="noopener noreferrer nofollow">went live</a> on 7 May, introduced EIP-7702, an improvement proposal allowing Externally Owned Accounts (EOAs) to temporarily act as smart contracts. However, this innovation has been filled with malicious copy-pasted code and it has put a significant amount of Ethereum users at risk.&nbsp;
In a latest X post, the Wintermute team revealed that 97% of EIP-7702 wallet delegations are tied to malicious “sweeper” contracts, designed to automatically drain ETH from compromised addresses. These contracts, dubbed “CrimeEnjoyor” by Wintermute, target wallets with leaked private keys, siphoning funds without user intervention.&nbsp;
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
 <blockquote class="twitter-tweet">
 While EIP-7702 brings new convenience, it also introduces new risks Our Research team found that over 97% of all EIP-7702 delegations were authorized to multiple contracts using the same exact code. These are sweepers, used to automatically drain incoming ETH from compromised… <a href="https://t.co/xHp7zr4hC9" target="_blank" rel="noopener noreferrer nofollow">pic.twitter.com/xHp7zr4hC9</a>— Wintermute (@wintermute_t) <a href="https://twitter.com/wintermute_t/status/1928501765865091400?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">May 30, 2025</a>
 </blockquote>
 </div>
</figure>
Wintermute’s Dune <a href="https://dune.com/wintermute_research/eip7702" target="_blank" rel="noopener noreferrer nofollow">dashboard</a> highlights over 79,000 addresses linked to these sweepers, with attackers spending 2.88 ETH to authorize them.&nbsp;
To find exact details, the research firm reversed the malicious bytecode into Solidity, verifying it as CrimeEnjoyor to expose its intent and warn users. Despite the large scale of the operation, no such exploits have been confirmed yet.&nbsp;
The Pectra upgrade aimed to streamline transactions through features like transaction batching and gas sponsorship. It was considered beneficial for early adopters like Uniswap and JumperExchange, which account for 95% of EIP-7702 flows on Ethereum. However, the lack of transparency in unverified contracts has enabled exploitation.&nbsp;
This finding has sparked concern in the crypto community, with experts urging users to exercise caution. As Ethereum evolves, the need for robust verification and transparency tools has never been more critical to protect users from such auto-drain threats.
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 Also read: <a href="https://www.cryptotimes.io/2025/06/02/institutional-investors-shift-ethereum-bitcoin-xrp/" target="_blank" rel="noopener noreferrer nofollow">Institutional Investors Shift to Ethereum From Bitcoin &amp; XRP: Data</a>
</blockquote>

Pectra Upgrade Has Put Ethereum Wallets on “Auto-drain” Risk: Wintermute

The Crypto Times

Other articles published on Jun 2, 2025

Join our free newsletter for daily crypto updates!