Ethereum's EIP-7702, which lets a regular wallet use delegated smart-contract code without changing its address, introduced a new security risk because that code can act with the account's authority. A peer-reviewed study released for USENIX Security '26 found attacker-linked contracts associated with 2,322,548 of 3,664,166 EIP-7702 authorization transactions across Ethereum, Binance Smart Chain, Polygon, Optimism, Arbitrum, Base and Gnosis through July 15, 2025. The 63% figure measures transactions, not distinct wallets or the attack rate in 2026. Researchers identified and manually reviewed 924 malicious contracts, including 793 targeting externally owned accounts, 124 targeting contract accounts and seven composite attacks. The study measured realized losses of $2,362,848.76 across three attack categories and estimated about $10.14 million in potential exposure in a separate legacy-contract subset. EIP-7702 went live with Ethereum's Pectra upgrade on May 7, 2025, allowing an externally owned account to point to deployed code while retaining its address and private-key control. The mechanism can support smart-wallet features such as batched calls and sponsored transactions, but buggy or hostile code may also execute approvals, transfers and application calls as the account. The researchers said attacker-controlled contracts were reused disproportionately, making transaction counts rise faster than the number of affected users or contracts. They also found rebinding to benign code after attacks, 500 nonzero delegation targets with no deployed code and legacy contracts whose defenses relied on the obsolete assumption that msg.sender == tx.origin identifies a plain wallet. Ethereum.org guidance calls for whitelisting delegation contracts, displaying targets clearly, avoiding arbitrary delegation on hardware wallets and using audited implementations. Developers are encouraged to request user-facing capabilities through wallet interfaces such as ERC-5792 rather than selecting low-level delegation code, while wallets should maintain durable authorization histories and treat delegation as installation of the account's control plane.