What Is an EOA Wallet? Ethereum Account Types After EIP-7702

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: An EOA (externally owned account) is a normal Ethereum wallet address controlled by a single private key, like the one MetaMask, Rabby or a Ledger creates for you. It's one of Ethereum's two base account types; the other is a contract account, which is controlled by code instead of a key. Since the Pectra upgrade on May 7, 2025, EIP-7702 lets an EOA point to contract code and act like a smart account, but the private key still has full control. That last point is why a leaked EOA key can't be "fixed", only escaped.

Most of the wallets I help rescue are EOAs, and most of the confusion I see starts with not knowing what kind of account you actually have. "Can I change my password?" "Can I add 2FA?" "Can I remove the hacker's delegation and keep using the wallet?" The answers all depend on the account type, so here's the plain version.

What does EOA stand for in crypto?

EOA stands for externally owned account. "Externally" means it's controlled from outside the blockchain by whoever holds the private key, rather than by code living on-chain.

The ethereum.org accounts page defines two account types:

Externally owned account (EOA): controlled by anyone with the private key.
Contract account: a smart contract deployed to the network, controlled by its code.

Both can hold ETH and tokens and interact with contracts. The difference is who decides what the account does.

What is an EOA wallet?

An EOA wallet is any wallet where one private key (usually derived from your seed phrase) signs every transaction. MetaMask, Rabby, Trust Wallet, Coinbase Wallet's default accounts and the addresses on a Ledger or Trezor are all EOAs. The hardware wallet just keeps the key on a separate device; the account type is the same.

A few properties follow from that:

Creating one is free. The address is calculated from the public key (the last 20 bytes of its Keccak-256 hash), so nothing is written on-chain until you use it.
Only an EOA can start a transaction. Contracts only run when something calls them. Every chain of actions on Ethereum begins with an EOA signing a transaction and paying gas, which is also why a rescue needs ETH for gas somewhere.
The key is the account. There's no password reset, no owner change and no recovery process built into the protocol. Whoever has the key has the account, forever.

What are the different types of Ethereum accounts?

At the protocol level there are still two. In practice, wallets today fall into four groups:

Account type	Controlled by	Can start a tx?	Can rotate the key?	Examples
Plain EOA	One private key	Yes	No	MetaMask, Rabby, Ledger addresses
Contract account	Its code	No (only when called)	n/a	Uniswap pools, token contracts, MEV bot executors
Smart account (contract wallet)	Code + owner keys or rules	Via an EOA or an ERC-4337 bundler	Yes, if the code allows it	Safe multisig, ERC-4337 wallets
EIP-7702 delegated EOA	The private key, plus delegated code	Yes	No, the original key stays in control	EOAs upgraded by wallets for batching or gas sponsorship

A smart account is a wallet that is itself a contract. A Safe, for example, can require 2 of 3 owners to sign and lets you replace a lost or compromised owner key. ERC-4337 standardized smart accounts that send "user operations" through bundlers without needing their own EOA for every action.

What is the difference between an EOA and a smart contract wallet?

The EOA's rules are fixed by the protocol; a smart contract wallet's rules are whatever its code says.

That difference shows up in exactly the situations people ask me about:

Multisig and spending limits. Impossible for a plain EOA. Normal for a Safe.
Changing the key. Impossible for an EOA. A Safe can swap an owner in one transaction signed by the remaining owners.
Paying gas in USDC or having someone else pay it. Not native for an EOA. Supported by smart accounts through ERC-4337 paymasters.
Compatibility. EOAs work everywhere. Some older dapps still assume the signer is an EOA and break with contract wallets.
Cost. An EOA costs nothing to create. A smart account has to be deployed, which costs gas.

For bots, nearly everything I build uses an EOA to sign and a contract account to execute: the EOA sends the transaction, and the contract does the multi-step swap atomically and reverts if it isn't profitable.

How does EIP-7702 change EOAs?

EIP-7702 lets an EOA set a pointer to an existing contract, so calls to the EOA run that contract's code. It went live on Ethereum mainnet with the Pectra upgrade at epoch 364032 on May 7, 2025.

Technically, the EOA's owner signs an authorization (chain ID, the contract address and a nonce). Anyone can submit it in a new type 4 transaction, and the protocol writes a delegation indicator, 0xef0100 followed by the contract address, into the EOA's code. The EOA that signs is called the authority; the contract it points to is the delegate. The delegation stays until it's replaced, and pointing it at the zero address clears it.

This gives normal wallets smart-account features like batching an approve and a swap into one transaction, or letting a sponsor pay gas. But ethereum.org's EIP-7702 guidelines are explicit: the private key keeps full control after delegating. Delegating to a Safe doesn't make your EOA a multisig, because the single key can still bypass any rule the code sets.

Why does the account type matter if your key leaks?

Because an EOA with a leaked key can never be made safe again. You can only move what's in it to a new wallet, ideally before the attacker does.

With a plain EOA, the attacker usually runs a sweeper bot that grabs any ETH the moment it lands, so you can't pay gas to move tokens out. EIP-7702 gave attackers an upgrade: they sign a delegation from your EOA to a sweeper contract, and from then on incoming ETH can be forwarded by code. Wintermute reported in May 2025 that over 97% of EIP-7702 delegations pointed to copies of the same sweeper code, which they nicknamed "CrimeEnjoyor".

Clearing that delegation doesn't help on its own, because the attacker still has the key and can sign a new one. I cover the checks in how to check and remove a malicious EIP-7702 delegation and the rescue options in EIP-7702 rescue vs Flashbots bundles.

A smart account is different. If one owner key of a 2-of-3 Safe leaks, the attacker can't move funds alone, and the other owners can remove the leaked key. That's the strongest practical argument for keeping large balances in a smart account.

How do you check what type of account an address is?

Ask a node for the address's code. It takes one call:

Open the address on Etherscan. A contract shows a "Contract" tab, and Etherscan also labels EIP-7702 delegations on the address page.
Or call eth_getCode on the address through any RPC (for example cast code <address> with Foundry).
Read the result:
- 0x (empty): a plain EOA.
- 0xef0100 followed by 20 bytes: an EOA with an EIP-7702 delegation. The 20 bytes are the delegate contract's address.
- Anything else: a contract account (a token, a pool, or a smart wallet like a Safe).

If you find a delegation on your wallet that you didn't set up, treat the key as compromised and follow the compromised wallet checklist.

Frequently asked questions

What is an EOA in blockchain?

An externally owned account is an address controlled by a private key rather than by code. It's the standard wallet type on Ethereum and other EVM chains, and it's the only account type that can start a transaction.

Is MetaMask an EOA wallet?

Yes. MetaMask accounts are EOAs, including ones secured by a connected Ledger. MetaMask can also use EIP-7702 to add smart-account features to the same address, but the account is still controlled by your private key.

Are ERC-20 tokens the same as ETH?

No. ETH is Ethereum's native currency and is stored as the account's balance at the protocol level. ERC-20 tokens are entries in a token contract's storage, so moving them means calling that contract, which needs ETH for gas.

What is the difference between authority and delegate in EIP-7702?

The authority is the EOA whose owner signs the EIP-7702 authorization. The delegate is the contract whose code the EOA will run. The authority's private key keeps full control either way.

Can an EOA become a smart contract wallet?

With EIP-7702 it can run smart-wallet code at the same address, but the original key can still override everything. To get real key rotation or multisig, move funds into a smart account such as a Safe.

Can I change the private key of my EOA?

No. The address is derived from the key, so a new key means a new address. If your key leaked, create a new wallet and move your assets to it.

At MEV DAO most of my rescue work is on EOAs whose keys have leaked, often with an EIP-7702 sweeper attached. If that's where you are and tokens are still in the wallet, the Token Rescue Bot page explains how a rescue works, or you can message me on Telegram.