My Ethereum wallet was compromised through a malicious smart contract delegation (EIP-7702 authorization), not a direct theft of my private key. I believe I was tricked into signing a malicious authorization — likely disguised as a token "claim," wallet "verification," or airdrop signature request on a phishing site — around September 3, 2026. I do not recall the exact site, as the delegation sat dormant afterward without any obvious signs of compromise. This delegation gave a smart contract deployed by the attacker (address ending in ...517E7DE9A) standing authority to execute transactions from my wallet without needing my private key or further approval from me. On September 23, 2026, once my wallet accumulated a real USDT balance, the attacker used this pre-existing delegation to execute a transfer directly from my wallet to their own address, moving 5,132.86 USDT (approximately $5,131 USD) out in a single transaction, using a Multicall/"Aggregate" method routed through my wallet's delegated contract. I did not authorize or initiate this specific transfer — it executed automatically once funds were present, as a result of the delegation set up weeks earlier. The stolen funds (5,283.89 USDT and 150 USDC total, including funds apparently taken from other victims) are, as of this report, still sitting unmoved in the attacker's wallet and have not yet been sent to an exchange or mixer.