BTC $77,774 
ETH $2,239 
MGLOEURO $111,813 
USDT $0.9990 
BNB $701.92 
XRP $1.25 
USDC $0.9996 
SOL $94.98 
TRX $0.3341 
FIGR_HELOC $1.03 Hacks & Security · Explained
EIP-7702 didn't cause the Binance hack, analysts say, but may have widened it
Security firms say compromised signing infrastructure drove the $6.3 billion theft, while Ethereum's delegation feature may have helped attackers bypass
Key takeaways
- Not the root cause. Security researchers say the attackers already controlled Binance's transaction signing path and could have taken the funds without EIP-7702.
- Possible amplifier. On Ethereum, a pre-signed EIP-7702 delegation turned a hot wallet into attacker-controlled code, allowing a single sweep instead of many transfers.
- Revocation risk. Ambire's Ivo Georgiev warns that teams may forget to revoke a malicious delegation even after regaining control of compromised systems.
What happened
Binance has confirmed that it lost $6.3 billion to attackers, the largest theft in the industry's history, and said it will cover all customer losses. According to Decrypt, the funds were moved out of exchange wallets on 10 separate blockchains on October 29, 2026, with most of the total leaving within roughly 20 minutes. TRM Labs and Chainalysis both attributed the operation to TraderTraitor, the North Korean group linked to the $1.5 billion Bybit breach in February 2025.
On Ethereum, the attacker is said to have used an EIP-7702 delegation to convert a Binance hot wallet into a sweeper contract under their control. TRM Labs reported that 50 authorizations were signed in advance, and Chainalysis said an operational wallet funded through the Tornado Cash mixer submitted them, after which the attacker called the wallet to move its assets to addresses they controlled. EIP-7702, introduced with Ethereum's Pectra upgrade, lets an ordinary account point to smart-contract code while keeping its address and balance.
The mechanism, however, requires a valid signature from the account being upgraded. Wallets on the other nine chains sent funds through standard signed transfers, which TRM said indicates a compromise of Binance's hot wallet signing infrastructure rather than a weakness in Ethereum itself. Binance said its investigation started with an engineer's compromised laptop and later uncovered additional points of breach, while chief executive Richard Teng said investigators had found no sign that private keys leaked.
First $2.7KLatest $2.2K-17.5% over the period
Points are daily observations, not closing prices.
Why it matters
Ido Ben-Natan, co-founder and chief executive of the security firm Blockaid, told Cointelegraph that the attackers could have carried out the theft without EIP-7702 at all. In his view, the upgrade offered a way to do it in a single sweep and possibly a route around some of the checks that would otherwise apply, where the hackers would otherwise have needed multiple transactions. He described the likely entry point as a compromised developer machine that gave attackers the ability to propose transactions to a heavily protected signer holding one of Binance's hot wallets, concluding that the signer ultimately approved a transaction it should have rejected.
Ivo Georgiev, co-founder of the Ethereum wallet provider Ambire, argued that EIP-7702 made little practical difference because the attackers already held the ability to authorize transfers. He did flag a separate concern: exchange engineers who regain control of their systems might not realise they also need to revoke a malicious delegation, which he said is poorly understood. Ben-Natan added that similar attacks on signing systems remain a threat to other exchanges and suggested transaction simulation as a way to catch malicious requests before approval.
What the data shows
The published figures differ slightly by outlet: Decrypt put the total moved at about $6.4 billion, while Binance's own confirmation and Cointelegraph's reporting cite $6.3 billion. Both accounts describe activity across 10 blockchains, with the bulk of the funds leaving in around 20 minutes on October 29, 2026. TRM Labs counted 50 pre-signed authorizations behind the Ethereum delegation, and Chainalysis traced the submitting wallet's funding to Tornado Cash. For scale, the reports compare the loss with the $1.5 billion Bybit hack of February 2025 and with Wintermute's finding that over 80% of early delegations pointed at malicious sweepers.
Background
EIP-7702, titled "Set Code for EOAs," was written in May 2024 by Ethereum co-founder Vitalik Buterin alongside developers Sam Wilson, Ansgar Dietrichs and lightclient. It shipped as a headline feature of Pectra, which went live on May 7, 2025, and adds a transaction type carrying signed authorizations that point an account at a contract. The account then stores a delegation indicator, marked with the byte 0xef, and runs that contract's code with full access to its funds until the owner signs a new authorization or clears it. The specification itself cautions that there is no safe way to offer users an interface for signing such authorizations.
Warning signs appeared quickly. In June 2025, The Block reported that trading firm Wintermute had found more than 80% of early EIP-7702 delegations pointing to copies of a single malicious sweeper contract that drains wallets with leaked keys. In September 2025, holders of World Liberty Financial tokens reported losses tied to malicious delegations. An Ethereum community member known as VEER said the Binance incident looked broader than one bad signature but that EIP-7702 handed attackers what amounted to a convenient sweep button on Ethereum.
What to watch
The immediate question for exchanges is whether any delegations granted during the breach remain active, since a delegation persists until the account owner signs a fresh authorization or clears the pointer. Binance has said its review found more points of breach beyond the initial laptop, without detailing them publicly. Further out, Ethereum developers are discussing EIP-8141, which Buterin in February 2026 described as an omnibus addressing the remaining problems of account abstraction, with a possible path to inclusion in the Hegotá upgrade that is planned to follow Glamsterdam.
Questions readers ask
Did EIP-7702 cause the Binance hack?
No. According to Blockaid, Ambire and onchain analysts, the attackers had already compromised Binance's wallet signing infrastructure and could have moved the funds through ordinary signed transfers. The delegation may have helped them act in fewer steps and avoid some checks.
What is EIP-7702?
It is an Ethereum change, shipped in the Pectra upgrade in May 2025, that lets a regular wallet temporarily run smart-contract code while keeping its address and funds. It was designed as a step toward account abstraction.
Why do delegations worry security researchers?
A delegation gives the linked contract unrestricted access to the account's funds, and it stays in place until the owner signs a new authorization to change or remove it. Researchers say this is easily overlooked during incident response.
