Account Abstraction Goes Native: The 2026 Smart-Account Guide

The month account abstraction stopped waiting

For most of its history, account abstraction has been a promise with a footnote. The idea is simple to state: let a crypto wallet behave like programmable software instead of a bare pair of keys. On Ethereum it has been technically possible since 2023. Making it work in practice, though, meant bolting an extra layer of infrastructure onto a chain that was never built for it. In September 2026 that footnote starts to disappear. Base, the Coinbase-built layer-2 network that is now one of crypto’s busiest chains, plans to ship native account abstraction directly into its protocol in an upgrade it calls Cobalt, turning smart-account behavior into a built-in property of the chain rather than an accessory (Bitget News).

The distinction matters more than it sounds. Every feature people associate with a modern wallet, paying fees in a stablecoin, batching five approvals into one click, signing in with a passkey instead of a seed phrase, recovering an account without a scrap of paper, has until now depended on either a parallel transaction system or a temporary code upgrade grafted onto an old-style account. Native account abstraction removes the scaffolding. It is the difference between an adapter and a wall socket.

This guide explains what account abstraction is, how the two dominant approaches (ERC-4337 and EIP-7702) actually work, why the Cobalt upgrade and its underlying standard represent a turning point, and what all of it means for the wallets and exchanges most people touch every day. The short version: the plumbing is finally being moved inside the walls, and by the end of 2026 the phrase smart account is likely to describe the default rather than the upgrade.

Account abstraction, defined

Ethereum has always had two kinds of accounts. The first is the externally owned account, or EOA, the familiar wallet controlled by a single private key. If you hold the key you control the funds; if you lose it they are gone; and every action requires that one key to sign. The second is the contract account, a smart contract with its own code and rules but, crucially, no ability to start a transaction on its own. For years the powerful account (the smart contract) could not initiate anything, and the account that could initiate everything (the EOA) was rigid and dumb.

Account abstraction collapses that split. It lets an account be governed by arbitrary code, whatever validation logic its owner chooses, while still being able to send transactions and pay fees. A smart account can require two signatures for large transfers and one for small ones, accept a fingerprint or a passkey instead of a seed phrase, let a game move an in-game item without a pop-up, cap daily spending, or let a friend help you recover access. The private key stops being the account and becomes just one possible way to authorize it.

There are three routes to that outcome, and 2026 is the year all three are in production at once. The table below lays them side by side.

ERC-4337: smart accounts without touching the chain

The first route, and still the largest by raw usage, is ERC-4337. Finalized in March 2023, it delivered account abstraction without changing Ethereum’s core rules at all, an important trick because hard forks are slow and politically expensive (EIP-4337 specification). Instead of a normal transaction, a 4337 user signs a UserOperation, a richer instruction that describes what they want done. These UserOperations collect in a separate mempool, get packaged by specialized actors called bundlers, and are submitted to a single audited contract, the EntryPoint, which verifies each one and executes it.

Two supporting roles make the model useful. Bundlers pay the actual gas and get reimbursed, so the user never has to hold the chain’s native token to move. Paymasters, optional contracts that agree to sponsor fees, are what make gasless transactions and paying fees in USDC possible. The current EntryPoint release, version 0.8, shipped in 2025 and added direct support for the newer EIP-7702 path, a sign of how quickly the two approaches are converging (eth-infinitism releases).

The scale is no longer theoretical. As of late August 2026, tracker BundleBear counts more than 1.26 billion UserOperations processed across chains, roughly 65 million accounts with on-chain activity, and about $13.6 million in gas covered by paymasters (BundleBear). The catch, and the reason the story does not end here, is that 4337 relies on that parallel mempool and its bundlers. They are extra infrastructure, and extra infrastructure is a place where power can concentrate or things can break.

EIP-7702: the switch that reached wallets you already own

The second route is newer and, in a sense, more radical. EIP-7702, authored by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and Matt Garnett and activated in Ethereum’s Pectra upgrade on 7 May 2025, lets an ordinary EOA temporarily borrow the code of a smart contract (EIP-7702 specification). Through a new transaction type (0x04), a user signs an authorization that points their plain account at a contract’s logic. From that moment the old wallet can batch actions, accept sponsored gas, and use custom validation, all the smart-account tricks, without migrating funds to a brand-new address.

The delegation is recorded on-chain as a short marker (the bytes 0xef0100 followed by the contract address) and, crucially, it is revocable: point the authorization at the zero address and the account reverts to a plain EOA. That reversibility is why every major wallet reached for 7702 first. It upgraded the hundreds of millions of existing addresses in place rather than asking anyone to move (ethereum.org, Pectra).

Adoption has been fast and messy. BundleBear’s 7702 dashboard shows more than 234 million cumulative authorizations and roughly 53 million live delegations as of late August 2026 (BundleBear). Much of that early volume was not users at all but automated sweeper contracts racing to drain already-compromised keys, a quirk that made the raw numbers look alarming without reflecting a flaw in the standard itself. The lesson that carried into 2026 was blunt: giving an old account new powers also gives an attacker new powers if the user can be tricked into signing.

Going native: Base’s Cobalt upgrade and EIP-8130

Which brings us to the third route, and the reason this is being written now. Both ERC-4337 and EIP-7702 are workarounds, elegant ones, but workarounds. Native account abstraction bakes the behavior into the protocol so that no side mempool, no bundler, and no borrowed code is required. Base intends to be the first major network to ship it at scale. Its Cobalt upgrade, scheduled for September 2026, implements a standard called EIP-8130, and the pitch is that smart-account features stop being an app-layer bolt-on and become a property of the chain (Base engineering blog).

EIP-8130, drafted in October 2025 by Coinbase engineer Chris Hunter, introduces a dedicated transaction type (0x79) and an on-chain Keystore contract that stores an account’s authentication preferences (Crypto Briefing). Rather than allowing arbitrary validation code, it fixes a canonical set of authenticators, secp256k1 (Ethereum’s default), P-256 (the curve behind passkeys and phone secure enclaves), WebAuthn, and a delegate option, and lets accounts configure which they use. It defines two tiers: a flexible Level 1 aimed at Ethereum mainnet, and a restrictive Level 2 tuned for high-throughput chains such as Base. Older 4337 accounts keep working through a fallback.

The numbers behind the pitch are concrete. Base’s engineers report that a native USDC transfer under EIP-8130 costs roughly 46,000 gas, down about 63 percent from the 125,000 a comparable 4337 transfer needs, and shrinks the on-chain data by more than 83 percent. The Cobalt build lands three headline features natively: fee sponsorship (apps can pay users’ gas or let them pay in any token), batch calls (many actions in one transaction), and session keys (scoped permissions that cut repeat confirmations). Base built a temporary test network, Vibenet, so developers could try it before launch, and says OP Stack chains will follow later in 2026.

The effort has pulled in an unusually broad coalition, Base, Coinbase, Optimism and WalletConnect, which matters because a wallet standard is only as good as the number of wallets that honor it. Pedro Gomes, founder of WalletConnect, put his weight behind it publicly, writing that after spending months on a rival design he is “convinced EIP-8130 is the better path for native account abstraction,” calling it “simpler, more portable, and focused on what wallets actually need” (@pedrouid). That endorsement matters because the same upgrade cadence that brought Fusaka to Ethereum mainnet in December 2025, and reshaped the calculus for validators and solo stakers, is now carrying a genuine contest over how the base layer should handle accounts.

The standards fight nobody voted on

EIP-8130 is not the only proposal for native account abstraction, and the disagreement is philosophical as much as technical. Ethereum’s own researchers favor a maximal design. Buterin has championed an omnibus proposal, formalized as EIP-8141, that aims to solve every remaining account-abstraction problem at once, including support for arbitrary validation logic and post-quantum signatures. He has framed native AA as long overdue, noting the community has “been talking about account abstraction ever since early 2016,” and argued the omnibus “wraps up and solves every remaining problem that AA was intended to address,” possibly, in his words, “within a year” (Cointelegraph).

The camps split on how much freedom to give accounts. EIP-8141 (the Ethereum Foundation direction) maximizes flexibility and lets accounts pay gas in tokens with no off-chain help, at the cost of complexity and new work for validators. EIP-8130 (the Base and Coinbase direction) trades that flexibility for a fixed, simpler menu that is cheaper and easier to make identical across many chains. A third, minimalist design associated with the Paradigm orbit, called Tempo, strips the feature set down further and rejects both arbitrary logic and token-denominated gas (Biconomy).

Underneath the design debate is a worry about centralization. Because 4337 smart wallets depend on bundlers and relays to get included in blocks, Buterin has warned that this dependence is a source of fragility, with no guaranteed alternative path to inclusion if those intermediaries misbehave or go offline. Native account abstraction is partly a response: if the base layer handles smart accounts directly, the side infrastructure and its choke points can shrink. The unresolved question is whether the ecosystem converges on one standard or fragments into several, each with its own wallet support.

Passkeys and the end of the seed phrase

For ordinary users, the most visible payoff of account abstraction has nothing to do with transaction types. It is the quiet disappearance of the twelve-word seed phrase. Smart accounts can verify signatures from the P-256 curve, the same cryptography that powers Apple’s Secure Enclave, Android’s Keystore, and the WebAuthn passkeys people already use to log in to websites with a fingerprint or face scan. That means a wallet can be secured by the phone’s hardware instead of a string of words on a sticky note.

The enabling piece is a precompile called RIP-7212, which added efficient P-256 verification to Ethereum-compatible chains. Before it, checking a passkey signature on-chain cost around 300,000 gas, enough to make the feature impractical; the precompile cut that to roughly 3,450 gas, close to a hundredfold improvement (Alchemy). With that in place, signing in with a passkey becomes economically sane, and several networks (Base and Polygon among the early movers) adopted it.

Passkeys pair naturally with social recovery, another account-abstraction feature Buterin has advocated for years. Instead of a single seed phrase whose loss is fatal, a smart account can nominate guardians (other devices, trusted people, or institutions) that can collectively restore access. The trade-off, and it is a real one, is that recovery now depends on the sync fabric behind passkeys and on the honesty of guardians, which moves the risk rather than removing it. The seed phrase is not gone everywhere, but for a growing share of new users it is no longer the first thing they meet.

Who pays for the gas

Gasless is one of account abstraction’s best demos and one of its most misunderstood. Nobody moves value for free; someone pays the validators. What account abstraction changes is who pays, and in what currency. The mechanism is the paymaster, and it comes in three broad flavors.

In the sponsorship model, an application eats the fee as a customer-acquisition cost, the on-chain equivalent of a retailer covering shipping. In the ERC-20 model, the user pays in a stablecoin such as USDC and the paymaster converts it, usually adding a markup to cover price swings. In the verifying model, an off-chain service decides case by case whether to sponsor a given operation. Circle’s paymaster, live on Arbitrum and Base, lets users pay gas in USDC on any 4337 account and takes roughly a 10 percent surcharge for the convenience (Circle).

The economics push account abstraction toward cheaper chains. A sponsored operation that costs a fraction of a cent on a layer-2 like Base can cost dollars on Ethereum mainnet, which is why most consumer smart-wallet activity has clustered on rollups, and why Base’s native, cheaper design is aimed at exactly that traffic. For an exchange or a game footing the bill for millions of users, the gap between mainnet and an L2 is the difference between a viable feature and a budget line that never closes.

Session keys and the software that acts for you

The account-abstraction feature with the widest long-term reach may be the least glamorous: session keys. A session key is a temporary, tightly scoped permission, in effect telling a wallet “this app may sign transactions of this type, up to this limit, for the next hour,” granted once so the user is not prompted to approve every action. In a game, that means moving items and spending in-game currency without a wallet pop-up interrupting play. Standards such as ERC-7715 are formalizing how a wallet grants and revokes those permissions (ERC-7715 draft).

The same primitive is what makes autonomous software agents workable on-chain. An AI agent can be handed a session key scoped to a specific budget and set of actions, letting it trade, pay for services, or rebalance a position without ever holding the master key. That is powerful and unnerving in equal measure: a scoped key that misbehaves still has a blast radius, and handing spending authority to a program raises the same trust question as renting compute you do not control. Getting the scoping right, tight limits, short lifetimes, easy revocation, is the difference between a convenience and a liability.

Session keys are also where account abstraction meets the messy reality of revocation. A permission that is easy to grant has to be just as easy to withdraw, and the better wallets treat a live session key like a standing authorization the user can review and cancel at any time, not a fire-and-forget grant. That is why the standards work around permissions is as much about the revoke path as the grant path: a scoped key with no clean off switch is a liability waiting to be found. As games, subscriptions, and agent-driven strategies come to lean on session keys, the wallets that earn trust will be the ones that make the list of who can act on your behalf both visible and reversible.

Programmable accounts, programmable risk

Account abstraction moves validation from a fixed rule into code, and code is an attack surface. The most expensive lesson to date is Bybit. On 21 February 2025 the exchange lost about $1.5 billion, the largest crypto theft on record, and the compromised cold wallet was a Safe smart account (NCC Group). The contract itself was not broken; attackers tied to the Lazarus Group compromised a developer machine and injected malicious code into the wallet interface, so that signers reviewing a routine transfer actually authorized a swap of the account’s underlying logic to a contract the attackers controlled.

The failure was blind signing: the signers, using hardware wallets, saw only a hash they could not read. As Odysseus, founder of the security firm Phylax, put it after the hack, “a hardware wallet is pointless if the transaction is signed on an internet-connected laptop or phone” (The Block). A hardware wallet still shows only what its screen can render, which is why the industry response has centered on clear signing (the ERC-7730 standard that translates a transaction into human-readable terms before you approve it) rather than on faster keys (Ethereum Foundation).

The broader risk map is nuanced. Phishing losses actually fell in 2025, down about 83 percent to $83.85 million by Scam Sniffer’s count, even as attackers weaponized 7702 delegations and stablecoin approvals (Cointelegraph). The throughline is that a smart account is only as trustworthy as the contract it delegates to, which is why formal verification of account code has moved from a nice-to-have toward something closer to table stakes. Programmability giveth and it taketh away: the same flexibility that lets a wallet protect you lets a bad contract drain you if you approve it.

What it means for exchanges and self-custody

For exchanges, account abstraction is quietly redrawing the line between custodial and self-custodial. Embedded wallets, smart accounts spun up behind a familiar email or social login, let a platform give users self-custody that feels like a normal app. Coinbase made its embedded wallets generally available in October 2025, storing keys in secure hardware the company says it cannot access, and its consumer-facing Base Account uses passkeys and spend permissions on the same rails (Coinbase). The user experience converges on the exchange; the custody quietly does not.

US regulation has, for now, made room for this. In an April 2026 staff statement, the Securities and Exchange Commission said that software merely enabling users to transact from their own self-hosted wallets is not, by itself, acting as a broker, provided it does not solicit, route orders, or take custody (CoinDesk). That gives wallet makers and the self-custody features of account abstraction a clearer runway in the United States, even as the same anti-money-laundering pressure that has cost some crypto users their bank accounts continues to fall on the custodial exchanges that plug into these wallets.

Institutions are moving too. Safe, the dominant smart-account platform for treasuries and DAOs, processed roughly 130 million transactions in a single quarter of 2026 and holds tens of billions of dollars in assets (The Block). Its president, Lukas Schor, has argued that Safe is “evolving from infrastructure that safeguards value into a network that can also help verify how value moves,” a hint that the next round of competition among smart accounts is less about custody and more about verifiable policy.

The wallets and platforms to know

The account-abstraction market in 2026 is crowded, and most of the names people already use have picked a lane. The table below sketches the major players and the standard each leans on. With ETH trading around $2,460 in late August 2026 (CoinDesk), the incentive to make Ethereum and its layer-2s easier to use has rarely been higher.

Two patterns stand out. First, almost every consumer wallet reached for EIP-7702 to upgrade existing users, then layered 4337 or native features on top. Second, the biggest platforms (Coinbase, MetaMask, Safe) are increasingly shipping their own account logic rather than relying on a single shared standard, which is exactly the fragmentation the native-AA debate is trying to head off.

The road after Cobalt

Cobalt is a beginning, not an endpoint. Base is a layer-2, and shipping native account abstraction there is easier than doing the same on Ethereum’s base layer, where changes are slower, more contested, and carry consequences for every rollup built on top. The Ethereum roadmap has been drifting in the same direction for years. Fusaka, activated on mainnet in December 2025, focused on data availability and a higher gas limit rather than on accounts, but it showed the network can still ship ambitious hard forks on schedule. The account-abstraction omnibus, EIP-8141, is aimed at a later fork, and its timing is not locked; Buterin’s own framing is that it could arrive within a year, which in practice means somewhere across 2026 and 2027.

That gap is exactly why the Base and Coinbase camp moved first with a narrower design. Rather than wait for Ethereum to settle on a maximal standard, EIP-8130 ships something usable now and bets that a simpler, portable feature set will spread across the many EVM chains before the perfect version is ready. The risk is plain: if Ethereum mainnet eventually adopts a different native standard, wallets could face two incompatible native account models, the very fragmentation the effort was meant to avoid. The optimistic case is that EIP-8130 becomes a de facto floor, a common baseline that a richer mainnet standard can extend rather than replace.

For users, the practical takeaway is that the transition will be gradual and mostly invisible. Existing 4337 and 7702 accounts keep working; native accounts arrive first where fees are lowest and activity is highest; and the wallet you already hold will most likely switch on native features without asking you to do anything. The interesting question for the next two years is not whether account abstraction wins, that argument is settled, but whose version of it becomes the standard the rest of the industry builds against.

A short checklist before you trust a smart account

Account abstraction is a genuine upgrade, but the flexibility that makes it useful is the same flexibility that makes it worth checking. A few practical questions before you rely on one:

• Can you read what you sign? Prefer wallets that support clear signing (ERC-7730) so a transaction shows what it does, not just a hash.
• What happens if you lose the device? Understand the recovery model (guardians, passkey sync, or a backup key) before you need it, not after.
• What code is your account delegating to? On 7702 and 4337, the security lives in the contract; favor implementations that have been audited and, ideally, formally verified.
• Who pays the gas, and what do they see? A sponsored transaction is convenient, but a paymaster is a party in your transaction; know the markup and the trust assumptions.
• Can you revoke? Whether it is a 7702 delegation or a session key, confirm you can cut off a permission quickly if something looks wrong.

None of this requires a computer-science degree, and by the end of 2026 most of it will be handled by wallets that hide the machinery. That is the point of the Cobalt moment. Account abstraction spent years as a feature you had to seek out and assemble. It is becoming a default you will use without thinking about it, which is both the goal and, for anyone who cares about self-custody, the reason to understand what is running underneath.

Frequently Asked Questions

What is account abstraction in simple terms?

Account abstraction lets a crypto wallet be controlled by programmable rules instead of a single private key. A smart account can batch actions, pay fees in a stablecoin, use a passkey or fingerprint, set spending limits, and be recovered through trusted guardians, all things a traditional key-only account cannot do.

Is account abstraction the same as ERC-4337 or EIP-7702?

No, those are two ways to achieve it. ERC-4337 adds smart accounts through separate infrastructure without changing Ethereum’s core rules. EIP-7702, live since the May 2025 Pectra upgrade, lets an existing wallet temporarily use smart-account code. Native account abstraction, arriving in Base’s Cobalt upgrade, builds the feature into the chain itself.

What is Base’s Cobalt upgrade?

Cobalt is a Base network upgrade scheduled for September 2026 that implements EIP-8130, a standard for native account abstraction. It aims to make fee sponsorship, batched transactions, and session keys built-in properties of the chain, and Base reports that a native USDC transfer costs about 63 percent less gas than the equivalent under ERC-4337.

Do smart accounts still need a seed phrase?

Increasingly, no. Because smart accounts can verify passkey signatures (using the same P-256 cryptography as your phone’s secure hardware), many new wallets let you sign in with a fingerprint or face scan and recover through guardians instead of a twelve-word phrase. The seed phrase is not gone everywhere, but it is no longer the only option.

Are smart-account wallets safe?

They are as safe as the code they run and the care you take when signing. The programmability that enables recovery and limits also creates new risks, as the 2025 Bybit hack showed when signers blindly approved a malicious contract swap. Favor wallets that support clear signing, use audited or formally verified account code, and let you revoke permissions quickly.

By Yuki Tanaka, senior wallets and exchanges correspondent at HOGE Wire.