Account abstraction: ERC-4337, EIP-7702 and smart wallets
Wallets that can use passkeys, pay gas in USDC and recover without a seed phrase, and the new trick scammers learned.
Account abstraction turns an Ethereum wallet from a single private key into a programmable smart account with its own rules: passkey logins, spending limits, recovery by friends, batched actions, and gas paid by someone else or in tokens. ERC-4337 made this possible without changing Ethereum's core in March 2023. EIP-7702, part of the Pectra upgrade on May 7, 2025, lets an ordinary address run smart-account code while keeping its address.
The problem with ordinary accounts
A normal Ethereum account (an "externally owned account", EOA) is controlled by one private key. That means:
- Lose the key or seed phrase and the funds are gone; leak it and they're stolen.
- You must hold ETH to pay gas, even to move a stablecoin.
- Each action is a separate transaction: "approve" and then "swap" means two signatures and two fees.
- No rules: the key can always send everything, anywhere, at once.
Smart-contract wallets fix all of this because code decides what a valid transaction is. Account abstraction makes them first-class.
ERC-4337 (live since March 2023)
ERC-4337 added account abstraction without a hard fork, by building a parallel system out of contracts. Its shared EntryPoint contract went live on Ethereum mainnet on March 1, 2023.
- You sign a UserOperation (a request) instead of a transaction, with whatever method your account accepts, such as a passkey on your phone.
- Bundlers collect UserOperations and submit them together to the EntryPoint.
- The EntryPoint asks your smart account whether the request is valid by its own rules, then executes it.
- An optional paymaster can sponsor the gas, so an app can cover fees for you or let you pay in USDC.
EIP-7702 (Pectra, May 7, 2025)
ERC-4337 accounts are new addresses, so moving to one meant moving all your assets. EIP-7702 lets an existing address keep its address and history while pointing to smart-account code. You sign an authorization naming a contract; from then on, calls to your address run that contract's code. The original private key still has full control and can change or remove the delegation.
Example. With a 7702-enabled wallet, you can approve a token and swap it in one click, with the gas paid in the token you're swapping, from the same address you've always used.
The new phishing risk
A 7702 authorization can hand control of everything at your address to whatever contract it names. Within weeks of Pectra, the trading firm Wintermute reported that over 97% of 7702 delegations pointed to copies of the same "sweeper" contract, mostly set up by thieves on addresses whose keys they had already stolen, to grab any funds sent there automatically. Only upgrade your account through your wallet's own built-in feature, and never sign a delegation request from a website.
What it enables
- Recovery without a seed phrase: guardians (other devices or trusted people) can help reset access.
- Passkeys and biometrics instead of seed phrases.
- Spending limits and session keys: a game can spend up to $5 for an hour without asking each time.
- Batching: several actions, one signature.
- Gas sponsorship: apps can pay fees for users.
Limitations
- Smart accounts are code, and code has bugs. A flaw in the account contract can put funds at risk.
- Recovery shifts trust to guardians or a company's servers; choose them carefully.
- Cross-chain differences: a smart account deployed on one network doesn't automatically exist on another, so sending to "your" address on a different chain can go wrong.
- Ethereum-centric. These standards apply to Ethereum and compatible chains; Bitcoin wallets work differently.
Frequently asked questions
What is account abstraction in simple terms?
Making your crypto account a small program with its own rules, instead of a single key that can do anything.
Do I need to do anything after Pectra?
No. EIP-7702 is optional. Your existing account works exactly as before unless you choose to upgrade it through your wallet.
Can a smart account pay gas in USDC?
Yes, if a paymaster supports it. The paymaster pays ETH for gas and charges you in USDC or another token.
Is a smart wallet safer than a normal wallet?
It can be, thanks to spending limits and recovery options, but it adds smart-contract risk. A well-audited account from a reputable wallet is the safer choice.
Can EIP-7702 be undone?
Yes. The account's private key can sign a new authorization that changes or clears the delegation. That also means anyone with the key, including a thief, can do the same.
Where to next
Sources
- ERC-4337: Account abstraction using alt mempool
- EIP-7702: Set code for EOAs
- Account abstraction (ethereum.org)
- Pectra upgrade (ethereum.org)
- Wintermute's new code flags wallet-draining contracts (Cointelegraph, June 2025)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.