Wintermute’s ‘CrimeEnjoyor’ to flag Ethereum’s wallet-draining contracts

by

Oh, brace yourselves, Ethereum enthusiasts! A new threat lurks on the horizon, ready to drain your precious wallets faster than you can say “blockchain.” Fear not, for Wintermute, that ever-so-innovative crypto market maker, has crafted a little something special to save your skins – a code named “CrimeEnjoyor.” Oh, how delightfully cheeky, don’t you think? 💼

This code, darling, is not just a fancy name; it’s the digital equivalent of a neon sign flashing “WARNING, DANGER AHEAD!” Wintermute’s brilliant little invention injects a warning right into the very contracts designed to do you dirty—those malicious Ethereum contracts designed to auto-sweep funds from unsuspecting wallets with leaked private keys. Talk about a sneaky business!

Picture this: A warning that practically screams, “HEY, BAD GUYS ARE USING THIS CONTRACT TO STEAL YOUR ETH!” It’s a shout-out to anyone who dares cross its path: “NOTHING TO SEE HERE, PLEASE DON’T SEND ANY ETH!” Now that’s the kind of digital safety we all need, isn’t it? 😏

But wait—let’s dive into the techy stuff, shall we? These malicious contracts are capitalizing on a feature from Ethereum’s Pectra upgrade called Ethereum Improvement Proposal-7702 (EIP-7702). This little gem lets users temporarily hand over control of their wallets to, yes, you guessed it—smart contracts. And let’s just say, these smart contracts are quite… *smart* in a very devious way. 💡

Wintermute’s team, ever the detectives, discovered that a whopping “97% of all EIP-7702 delegations were authorized to multiple contracts using the same exact code.” Surprise, surprise—these contracts are nothing but digital vacuum cleaners, sweeping up incoming ETH from compromised addresses. But, of course, they’re clever enough to make sure you don’t notice until it’s far too late. 🍂

And how did Wintermute manage to work its magic? By reversing Ethereum’s bytecode into human-readable Solidity code, they ensured the “CrimeEnjoyor” code would appear right where it needed to—front and center in those malicious contracts. Now, that’s what I call a reversal of fortune! 💸

“This one copy-pasted bytecode now accounts for the majority of all EIP-7702 delegations. It’s funny, bleak, and fascinating at the same time.”

EIP-7702 is optional, but transparency tools needed

Let’s clear something up, darlings. EIP-7702 is not mandatory. Oh no, no one’s forcing you to use it, like that one friend who insists on adding pineapple to pizza. You can still perform basic Ethereum operations, like transferring tokens, without it. But here’s the rub: while EIP-7702 gives Ethereum more flair, a lack of proper verification makes it harder for, let’s say, the less savvy among us to tell apart the good guys from the bad. And that, my friends, is where things get interesting. 🤔

“With more compromised contracts tagged, more activity can be surfaced and more users can be protected.”

And if you think you’re immune to this madness, think again! One poor soul—just one—decided to try out EIP-7702 and wound up losing a staggering $146,550 after signing several malicious transactions. Can you believe that? It’s enough to make you want to throw your crypto portfolio into the ocean. 🏝️

Since the grand Pectra upgrade on May 7, a total of 12,329 EIP-7702 transactions have been made. Quite the busy little corner of the internet, wouldn’t you say?

But Pectra didn’t stop there, darling! Oh no, it also brought along two other improvements. The first, EIP-725, increased the validator staking limit from a modest 32 Ether to a rather hefty 2,048 ETH—just what you need if you’re in the business of big stakers. And, of course, there’s EIP-7691, which promises to reduce those pesky transaction fees and improve scalability on Ethereum’s layer 2s. How thoughtful of them! 🍷

Read More

2025-06-02 05:23