EIP-7702 vs Permit2: Which Signature Drains Your Whole Wallet? (2026)
The security reflex most crypto users trained over the last two years is “watch out for Permit2.” That reflex is correct but now undersized. EIP-7702 delegation — the Pectra feature drainers adopted within days of its May 2025 launch — hands over the entire account, not a token allowance. A single October 2026 phishing batch transaction cost one victim approximately $1.54 million across staked ETH and BTC-pegged assets.
The one table that matters
| Permit2 / ERC-20 approve | EIP-7702 delegation | |
|---|---|---|
| What you approve | A spender for specific tokens | A contract that becomes your account |
| Scope | Token-scoped | Whole account: every asset |
| Future deposits | Not covered | Auto-swept |
| Revocation | Revoke the allowance, done | Re-delegate to zero address to reset code |
| Typical loss | The tokens you approved | Everything in the wallet |
| Detection | Allowance listings (revoke.cash approvals) | Delegations tab / SetCode type 0x04 on Etherscan |
Why the old advice stopped working
Token approvals have a built-in limit: they cover the token you signed for. Drain one token, the rest of the wallet stays safe unless you sign again. That limit shaped a generation of security advice — “check your approvals, revoke what you don’t need” — and it worked.
EIP-7702 removed the scope. The delegation does not name a token; it names a contract that now acts as your account, including every future deposit. The sweeper behind roughly 97% of malicious delegations (nicknamed CrimeEnjoyor) auto-forwards anything that arrives. The same phishing page that used to cost a few approved tokens can now cost the entire wallet in one click.
What this changes in practice
- Revoke hygiene is necessary but not sufficient. An empty-but-delegated account is still an account that forwards its next deposit to the attacker. Check the delegations tab, not just allowances.
- Separation of wallets matters more. High-value holdings should live in a wallet that has never signed an EIP-7702 authorization — separate from a hot wallet used for dApp interaction.
- Signature prompts need new reading habits. “Upgrade your wallet,” “delegate,” “authorize,” “set code” — any of these words on a prompt from a site you did not seek out is a stop sign. Full red-flag list in our EIP-7702 delegation attack guide.
FAQ
Is Permit2 still dangerous? Yes, within its scope: a malicious Permit2 signature lets the attacker move the tokens you approved. That is still the most common drainer vector by volume. EIP-7702 is the higher-severity escalation, not a replacement.
Can I revert an EIP-7702 delegation? Yes — send a new EIP-7702 transaction re-delegating to the zero address. Most wallets handle this internally. Until cleared, treat the address as exposed.
Which should I worry about more? Permit2 for frequency, EIP-7702 for severity. Both are defeated by the same habit: read what you are signing, and never delegate your account from a site you did not navigate to deliberately.
Educational content, not security advice. Last updated October 2026.
