The end of the private key era in Ethereum account abstraction

Safe’s September 2026 deployment of 10 million smart wallets surpassed MetaMask’s EOA user base. The Pectra upgrade on May 7, 2025, enabled EOAs to adopt smart features. Safe secures more assets than any other non-liquidity protocol in DeFi, with $35.25 billion in total assets spread across 61 million deployed accounts as of its Q1 2026 report. Users like Uniswap, ENS, Optimism, and Lido park treasury funds in Safe accounts. I judge that the shift toward programmable accounts ends the era of the simple private-key account. Traditional EOAs rely entirely on a single private key to authorize any action. Because an EOA lacks code, it cannot enforce rules, recover from lost keys, or batch two actions into one transaction. MetaMask accounts function as EOAs, requiring users to manage gas fees and secure a seed phrase. This simplicity allows for low costs but lacks the recovery mechanisms found in smart accounts like Argent, which uses social recovery to help users if they lose their keys. Smart accounts also allow for custom authorization logic and spending limits that traditional accounts cannot implement.

Two Paths for Account Abstraction

Account abstraction follows two distinct paths. ERC-4337, released in 2023, allows for the creation of entirely new smart contract wallets through bundlers and paymasters. This standard facilitated 26 million smart wallets and 170 million UserOperations. Paymasters allow users to pay fees in tokens like USDC, while bundlers collect UserOperations and pay gas upfront. While ERC-4337 facilitates complex workflows through specialized bundlers and paymasters, EIP-7702 provides a lighter path by allowing existing users to adopt smart features without migrating funds to entirely new blockchain addresses or incurring significant deployment costs. EIP-7702 uses Type 4 transactions with an authorization_list field to delegate execution to specific smart contract addresses. Users keep their existing addresses, preserving transaction history and NFT collections. ERC-4337 enables session keys, which allow limited permissions for specific use cases without exposing full account control. EIP-7702 remains compatible with existing infrastructure because it uses the standard mempool and functions as regular Ethereum transactions.

Users can also revoke EIP-7702 delegations when they no longer require smart features.

Interface Vulnerabilities and Security Risks

Security remains the primary concern as users move away from seed phrases. Security researchers found that 65% to 70% of early EIP-7702 delegations linked to phishing or scam activity. The Bybit incident in February 2025 illustrates that interface security remains a major vulnerability. Attackers, later attributed to North Korea’s Lazarus Group, compromised a developer machine inside the Safe organization to hijack AWS session tokens and swap a JavaScript bundle on the Safe frontend. This resulted in the theft of 401,000 ETH. The signers used Ledger hardware wallets, but the software showed them a routine ETH transfer rather than the malicious delegatecall they actually signed. CertiK reported $1.315 billion in stolen assets during the first half of 2026, with wallet compromises accounting for over $444 million. The Drift Protocol lost $285 million in April 2026 after attackers abused pre-signed transactions with no expiration policy. Humanity Protocol lost $36.4 million in June 2026 after a single compromised laptop controlled its multisig keys. In the first half of 2025, roughly $3.1 billion went to Web3 hacks, with Safe multisig wallets being major targets when interface integrity failed. You know the anxiety of managing a 12-word seed phrase, so the shift to passkeys or social recovery helps. Will the concentration of bundler operators eventually compromise the decentralization of the entire account abstraction stack?