Ethereum became more vulnerable in 2025, but was less attacked

A report published on January 3 by the security firm Scam Sniffer indicates that losses due to phishing in Ethereum fell drastically in 2025.

According to this source, in 2025 losses close to USD 84 million were recorded among 106,106 victims. 83% less than in 2024. Even so, the report warns that the drop in numbers does not imply the disappearance of the threat, but rather a shift towards more sophisticated attack techniques.

In addition, experts warn that a recent technical improvement has introduced new specific vulnerabilities. This is Improvement Proposal 7702 (EIP-7702), incorporated into Ethereum after the Pectra update, which was exploited by attackers to execute more complex malicious signatures.

He phishing It consists of inducing users to sign transactions, enabling the movement of their funds without the need to violate the network or its cryptography.

With EIP-7702, that risk can be expanded, since a single signature can group multiple operations, allowing hide approvals or transfers within authorizations that appear to be harmless.

From the first days after the activation of Pectra, users had already warned about the potential risks associated with this improvement.

Scam Sniffer data indicates that two of the most relevant cases linked to EIP-7702 were concentrated in August. with joint losses of USD 2.54 million.

Although Scam Sniffer did not include it in its report, among the attacks through EIP-7702 reported by NoticiasVE, one of the largest incidents of this type was recorded in August, with losses of USD 3 million for one user.

Other smaller robberies were added to these episodes, with losses that ranged between USD 900,000 and USD 33,000.

How did Ethereum’s EIP-7702 influence phishing attacks?

According to the Scam Sniffer report, malicious firms emerged after Pectra that exploited EIP-7702 to chain multiple harmful operations within a single commit.

EIP-7702 established a relevant change in the way external accounts (EOA) interact with smart contracts.

In simple terms, it allows a traditional Ethereum account to execute, using a single signature, a sequence of operations as if it were an account with abstraction (account abstraction). This enables “packages” of actions in a single user authorization.

That design improves the user experience (for example, reduces the number of signatures required), but it also expands the attack surface.

In practice, an attacker can induce the user to sign a transaction that appears to be legitimatebut which includes hidden actions: broad approvals, transfers or persistent permissions. Being “packaged”, these actions pass with a single signature, reducing alerts visible to the user.

Thus, although the dominant method continued to be the use of “Permit and Permit2” signatures (mechanisms that allow the spending of tokens to be authorized through an off-chain signature, without sending an immediate transaction), Scam Sniffer highlights the appearance of the EIP-7702 as a new attack vector emerged after the Pectra update.