EIP-7702: 12 revocations in 32,512 accounts in seven days

Between October 14 and 21, 2026, out of 32,512 accounts with active EIP-7702 delegation from a proprietary census of 32,994 Ethereum accounts, 12 withdrew it: 0.037%. Another 121 changed contracts, and the remaining 32,379 were still pointing to the same one a week later. EIP-7702 delegation—the feature introduced with the Pectra upgrade in May 2025 that allows a standard account, controlled by a private key, to execute contract code as if it were its own—is written once into the account's code field and is only removed by signing another instruction. In a proprietary census of 32,994 accounts read across two blocks separated by seven days, that field almost never moves: 98.14% of accounts remain delegated to the same contract as a week prior. The revocation percentage currently circulating, around 2%, is not a property of that population: when repeating the census with the sample shifted by 500 blocks, it rises to 3.99%, and the difference is caused by a single transaction of 650 instructions. These are two distinct things within the same number—the batch sweep sent by a single sender and the revocation signed by an individual account—and separating them reveals something else: where the remaining stock of delegations is concentrated.

What is an EIP-7702 delegation and what does it mean to revoke it?

An Ethereum account controlled by a private key has no code: only a balance and a nonce (the counter of signed operations). Since the Pectra upgrade (May 2025, block 22,431,084), EIP-7702 allows a type 4 transaction to write a 23-byte pointer into that account's code field—the prefix 0xef0100 followed by a contract address—and from that moment, the account executes that contract's code using its own balance and storage: batching operations, paying gas in a token, or delegating recovery without moving funds. In the census for this article, 32,512 of the 32,994 accounts that had signed a delegation had it active on Oct-14-2026 (block 26,191,146).

The pointer does not expire due to time or inactivity: it only disappears when the account signs another instruction with the zero address as the destination, which constitutes a revocation. Between October 14 and 21, 2026, 12 of those 32,512 accounts did so. It is similar to a token spending allowance, which also remains live until someone withdraws it—which is why it is advisable to review granted permissions—with a difference in scope: an allowance authorizes moving a specific token, while delegation replaces the logic of the entire account, which is what wallet drainers using leaked keys exploit.

What changed in the 32,994 accounts with EIP-7702 delegation between October 14 and 21, 2026?

The census is based on a systematic sample: one block every 1,000 from the Pectra block (22,431,084) to the anchor, plus the full window of 2,000 blocks prior to the anchor. From the type 4 transactions in those blocks, the signing account for each instruction is recovered from the signature, yielding 32,994 distinct accounts with recovered signatures. Then, the code field of all of them is read using eth_getCode at the exact anchor block, 26,191,146 on Oct-14-2026, and the reading is repeated for the same list at block 26,241,000, mined on Oct-21-2026.

A methodological clarification that changes the denominators: the anchor reading file contains 33,504 addresses because it also includes destination contracts, while the re-reading file contains 32,994, only the signing accounts. The two totals are not directly comparable, so all comparisons in this census are calculated based on the 32,994 accounts common to both readings.

The 12 revocations represent 0.036% of the 32,994 accounts in the census and 0.037% of the 32,512 that were delegated at the Oct-14-2026 anchor. In the same week, 21 empty accounts delegated again, so the delegated stock grew by nine: from 32,512 (98.54% of the 32,994) to 32,521 (98.57%), and empty accounts dropped from 482 to 473. The total movement of the code field in seven days consists of the 121 accounts that changed destinations plus the 12 that became empty: 133 out of 32,994, or 0.40%.

Between October 14 and 21, 2026, other metrics of the EIP-7702 delegated stock also remained stagnant. The three largest destinations went from 43.89% to 43.80% of the delegated stock; the largest among them from 23.15% to 23.14%; the six implementations listed by ethereum.org as known and audited from 3.93% to 3.92%; and the count of distinct destinations remained at 295 in both readings.

Why does the EIP-7702 revocation percentage change depending on the blocks in the sample?

The indicator currently circulating is not the stock of empty accounts: it is the proportion of signed instructions pointing to the zero address within an interval. In the systematic sample of the census, this is 618 out of 28,079, or 2.20%. To verify if that 2.20% describes the population or the interval, the entire census was repeated with the sample shifted by 500 blocks—blocks ending in 584 instead of those ending in 84, two disjoint sets of the same population—anchored at block 26,238,952 on Oct-21-2026.

The gross rate of EIP-7702 revocation instructions jumps from 2.20% to 3.99% between two disjoint samples of the same population (Oct-14 and Oct-21, 2026 anchors), and in the dense window, it goes from 0.34% to 3.67%, nearly an elevenfold increase. None of this represents a trend: the second sample captured block 26,172,584, where a single transaction signed by one sender account carries 650 revocation instructions, 56.8% of all revocations in that sample. In the dense window of that same anchor, one sender concentrates 451 of the 496 revocations—90.9%—in batches of exactly 50 instructions.

The two stable rows are those of the individual rate. Discounting transactions with two or more revocation instructions, the rate of accounts revoking their EIP-7702 delegation one by one is 1.29% and 1.65% in the two systematic samples (Oct-14-2026 and Oct-21-2026 anchors), and 0.34% and 0.33% in the two dense windows. This stability between two disjoint samples and two different anchors is what makes the individual rate usable. A gross figure without this separation merely measures which blocks happened to fall into the sample.

How to distinguish a batch sweep from an individual EIP-7702 revocation?

The separation is mechanical: a type 4 transaction can carry as many instructions as will fit, each signed by a different account, and the sender does not have to be any of them. In the 14,676 type 4 transactions in the census, 11,760 carry a single instruction (80.13%), 2,162 carry 2 to 9, 703 carry 10 to 49, and 51 carry 50 or more, totaling 7,016 instructions: 24.99% of the 28,079 in the systematic sample. The largest of all moves 1,000 different accounts in a single transaction, in block 23,586,084 on Oct-15-2025.

This arithmetic explains the peaks in the monthly series. In the systematic sample, October 2025 records 3,728 instructions with only 0.21% to the zero address and a density of 16.87 per sampled block, compared to 1.53 in July 2025: this is not diffuse adoption, but five transactions of 200 instructions on Oct-19-2025 and two of 501 and 200 on Oct-26-2025. The other peak in the series, March 2026 with 4,258 instructions, consists of three transactions of 330 on Mar-29-2026. At the other extreme, the month with the most revocations in the entire series is May 2026, with 216 out of 2,955 (7.31%), followed by September 2026 with 125 out of 2,149 (5.82%); the minimum is July 2025, with 0 out of 340. A month at 7.31% and another at 0.00% in the same population describes whether a batch transaction fell into the sampled blocks that month.

This census does not identify the sender of these batches: it counts accounts and cites truncated addresses. The only name with public attribution in this field was provided by Wintermute Research, the analysis arm of market maker Wintermute, in May 2025, when it reconstructed and verified the bytecode of contracts emptying accounts with leaked keys and dubbed it CrimeEnjoyor, as reported by The Block on Jun-1-2025, estimating that more than 80% of authorized delegations were copies of the same code; Cointelegraph, the following day, and the auditor Zealynx raised that share to over 97% of delegations in the first month. In our flow, that pattern no longer appears: the 463 distinct destinations in the systematic sample have 444 distinct bytecode hashes, and the six largest hashes correspond to only one address each. These are unique deployments, so grouping by bytecode no longer consolidates the major destinations.

Where is the stock of EIP-7702 delegations concentrated on Ethereum?

Of the 32,512 accounts delegated at the Oct-14-2026 anchor, the three largest destinations account for 43.89%: two out of every five accounts point to three contracts, out of 295 distinct destinations. The largest of the three holds 7,525 accounts, or 23.15%.

Of the top ten, four do not have verified source code on explorers. In the overall stock, 61.95% of delegated accounts point to a contract with a verified name on the Blockscout explorer, and 38.05% to contracts whose code has not been published. A verified name is public data—declared by whoever uploads the source code—and proves nothing about what the contract does, just as its absence proves nothing to the contrary. What is verifiable is the distribution: more than one in three delegated accounts in the census points to code that no one has published (32,512 accounts, block reading 26,191,146, Oct-14-2026).

How many EIP-7702 delegated accounts point to an audited implementation?

The ethereum.org page on EIP-7702, consulted on Oct-14-2026, lists six delegation implementations as known and audited. Among the six, by exact address, they account for 1,278 of the 32,512 delegated accounts at the anchor: 3.93%. One week later, at block 26,241,000 on Oct-21-2026, they account for 1,275 and 3.92%.

The two zeros have a nuance. The Simple7702Account from eth-infinitism, the reference team for ERC-4337, does appear in the census with 343 instructions in the dense window, but at a different address than the one listed by ethereum.org; it is counted separately because the list is by address and the count follows suit. In the flow, the six listed addresses capture 2.50% of the instructions in the systematic sample and 5.31% of those in the dense window, so their weight rises slightly in the 2,000 blocks prior to the Oct-14-2026 anchor, but remains an order of magnitude below the three largest destinations. 96.07% of the delegated stock in the census pointed outside that list on Oct-14-2026.

Why do the EIP-7702 authorization flow and the stock of delegated accounts not match?

The two counters measure different things, and one should not be read as a proxy for the other. Three effects separate them, all measured in the census.

An account can sign multiple times. In the dense window of 2,000 blocks prior to the Oct-14-2026 anchor, the largest destination receives 5,418 instructions from only 1,119 accounts: 4.84 per account in less than seven hours. The next five destinations range between 1.00 and 1.23 instructions per account. Counting authorizations quadruples the weight of the first; counting accounts leaves it at 23.15% of the stock on Oct-14-2026.

The stock moves after the flow snapshot. Of the 32,994 accounts in the census, 5,439—16.48%—point on Oct-14-2026 to a different destination than the one they signed in the sampled block. Destination 0x0727ca41… receives 990 instructions in the flow sample but has 3,529 accounts in the stock: 3.6 times more. The October 2025 cohort illustrates this best: of its 3,553 sampled delegations, 99.6% remain delegated on Oct-14-2026, but only 5.6% to the same destination they originally signed. Cohorts from April 2026 onwards remain between 94.6% and 96.5% with the same destination.

Not all instructions are applied. Of the 13,080 instructions in the 2,000 blocks prior to Oct-14-2026, 12,713 (97.19%) carried the exact nonce of the signing account in the previous block and took effect; 300 carried an already spent nonce and 67 a future nonce: 367 that did not take effect. The 12,713 is a lower bound and 367 an upper bound, as the calculation does not account for another transaction from the same account in the same block.

There is a fourth data point that explains much of the batch behavior: only 3.97% of the instructions in the systematic sample of the census (from Pectra to Oct-14-2026) are sent by the signing account itself (4.10% in the dense window). The remaining 96% travel in third-party transactions that pay the gas. And the recipient of the type 4 transaction is a verified ERC-4337 EntryPoint in 17.91% of the systematic sample and 25.21% of the dense window, placing one in four type 4 transactions in the dense window within the ERC-4337 smart account infrastructure and the other three outside of it.

What does this EIP-7702 delegation census not measure?

Four limitations, in order of importance.

1. The universe is a declared sample: one block every 1,000 from Pectra to the anchor, plus the full 2,000-block prior window, not the entire chain; any account that delegated outside those blocks is not included.
2. The set consists of accounts recovered from the signature of each instruction—40,630 out of 40,631 processed signatures were recovered—and they are 32,994 distinct accounts, not all addresses that have ever delegated across the entire network.
3. The seven-day re-reading shows what did not move in seven days, and one week does not disprove a slow abandonment.
4. No claims are made about destinations without published code: only how many accounts point to them.

With these limits in place, third-party counts fit where they should. A measurement by cryptoticker.io on Sep-13-2026 over a 200-block window yielded 4,035 instructions with 3.5% to the zero address and the largest destination concentrating 49.7% from a single sender: the same order of magnitude and the same dominant sender pattern we see in our dense window. The Block, using data from on-chain data consultancy Entropy Advisors, counted more than 11,000 authorizations in the first week after Pectra in May 2025, led by exchanges. And a 2026 USENIX Security study (Huang et al.), which the September ePrint 2026/2060 preprint repeats in its summary, estimates that 63% of EIP-7702 authorization transactions are linked to malicious contracts across seven chains, with data up to mid-2025: it classifies intent and counts transactions, not accounts, so it is not comparable to a mainnet account count like this one.

What remains is a portrait with three features. EIP-7702 delegation is signed once and almost never undone: 12 revocations in 32,512 accounts in the week of October 14 to 21, 2026. The stock is concentrated in three destinations that account for two out of every five delegated accounts, and the list of audited implementations from ethereum.org carries 3.92% of that stock. And any revocation percentage that does not separate a sender's batches from one-by-one revocations measures the sample's calendar, not the users. Measuring the Ethereum validator exit queue in October 2026 required the same preliminary step: deciding whether the unit of account is the aggregate or the agent before calculating the first proportion.

Sources and links: EIP-7702 (specification) · ethereum.org — EIP-7702 and known implementations · The Block, Jun-1-2025 — Wintermute and sweeper contracts · cryptoticker.io, Sep-13-2026 — 200-block window · USENIX Security 2026, Huang et al. — 63% of authorization transactions · ePrint 2026/2060, Sep-2026 — classification of delegations · Zealynx — wallet security with EIP-7702. Census, state readings, and counts: CleanSky calculation on public Ethereum nodes, anchors at blocks 26,191,146 (Oct-14-2026), 26,238,952, and 26,241,000 (Oct-21-2026).