A notorious scam group called Inferno Drainer has begun exploiting a new Ethereum feature to conduct wallet draining attacks
The group is taking advantage of EIP 7702, a key part of the Pectra upgrade, which allows External Owned Accounts (EOA) to temporarily function like smart contract wallets in transactions.
Sophisticated Crypto Fraud Tactic Exploiting Ethereum Smart Wallet Flexibility
On May 24, Scam Sniffer, a web3 anti-fraud platform, discovered a case where a newly upgraded wallet lost nearly 150,000 USD.
According to Yu Xian, founder of blockchain security company SlowMist, Inferno Drainer carried out the theft using a more sophisticated version of traditional fraud.
Unlike previous scams that directly hijacked user wallets, Xian explained that Inferno Drainer used an authorized MetaMask wallet—a wallet authorized under EIP-7702.
He said this allows hackers to silently approve token transfers through a batch authorization process.
Xian further noted that victims unknowingly activated the "execute" command in MetaMask, processing harmful batch data in the background. The result was a stealthy but effective token drain.
"The scam group uses this mechanism to complete batch authorizations on tokens related to the victim's address," Xian said.
Cryptocurrency fraud attack. Source: Scam SnifferThe security expert emphasized that this incident marks a shift in fraud tactics.
According to him, this shows that attackers are no longer relying solely on old tricks but are actively integrating new Ethereum updates into their operations to stay ahead.
"As we predicted, fraud groups have caught up... People should be vigilant and careful that assets in their wallet could be taken," Xian said.
Therefore, he calls on users to regularly review token authorizations and check whether their wallet addresses have been authorized to fraudulent accounts through EIP-7702.
Meanwhile, this case is part of a broader trend in the cryptocurrency industry. Last month, bad actors stole over 5 million USD from 7,565 individuals through phishing attacks.
For this reason, security experts have emphasized that cryptocurrency users must be proactive in protecting themselves from these attack methods.
Scam Sniffer advises industry members to verify websites before logging in or approving any transactions. They also call on the community to regularly check their token permissions and avoid clicking on unverified links.
