A crypto investor lost $1.54 million in a phishing scam exploiting Ethereum’s new EIP-7702, introduced in the May 2025 Pectra upgrade. The feature lets wallets act like smart contracts, enabling batch operations. Attackers used a fake DeFi site resembling Uniswap, tricking the victim into signing a malicious delegation that drained assets instantly, including wstETH and cbBTC. Security researchers warn that over 90% of EIP-7702 delegations link to malicious “sweeper” contracts. Experts urge users to verify URLs, limit approvals, revoke unused permissions, and use wallets with enhanced warnings. The case highlights innovation-security tradeoffs in Ethereum’s evolving ecosystem.