What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

EIP-7702, an Ethereum upgrade activated in May 2025, allows standard wallets to temporarily take on smart contract capabilities. This feature was exploited in October 2026 when attackers used it to drain $6.4 billion from Binance hot wallets across 10 blockchains, marking the largest cryptocurrency theft in history.

Blockchain analytics firms TRM Labs and Chainalysis both attributed the theft to TraderTraitor, the North Korean hacking group responsible for the $1.5 billion Bybit hack in February 2025. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper contract they controlled.

How EIP-7702 Works

Ethereum has two types of accounts: standard wallets (EOAs) controlled by private keys, and smart contracts that can run code. EIP-7702 bridges this gap by allowing existing EOAs to temporarily borrow code from smart contracts while maintaining their address and funds.

The upgrade introduces 'set code transactions' that carry authorizations signed with the account's private key, naming which smart contract address to use. Once processed, the account stores a delegation indicator pointing to that contract, allowing the contract's code to run with full access to the wallet's funds.

Security Risks

The same features that make EIP-7702 valuable carry significant security risks. Because delegated code gets 'unrestricted access to the account,' the specification warns that apps should never ask users to sign EIP-7702 authorizations and wallets shouldn't offer interfaces for it.

Scammers quickly exploited these vulnerabilities. Within weeks of Pectra's launch, trading firm Wintermute found that over 80% of EIP-7702 delegations pointed to malicious 'sweeper' contracts designed to drain wallets with leaked keys.

Binance Breach Details

In the Binance hack, the attacker used 50 pre-signed authorizations submitted through an operational wallet funded via crypto mixer Tornado Cash. This allowed the hot wallet to run attacker-deployed code and sweep assets into controlled addresses.

Binance confirmed that its investigation began with a compromised engineer's laptop and has since identified 'additional points of breach.' Notably, the theft on other blockchains occurred through ordinary signed transfers, suggesting a compromise of Binance's signing infrastructure rather than an Ethereum flaw.

Future of Account Abstraction

EIP-7702 represents a first step toward full account abstraction, a long-standing goal of making all Ethereum accounts as flexible as smart contracts. Its authors designed it to be forward-compatible with future developments.

The next step could come with Hegotá, the upgrade planned after Glamsterdam. In February 2026, Vitalik Buterin noted that EIP-8141, which he called 'an omnibus that wraps up and solves every remaining problem' account abstraction was meant to address, looked 'possible to make happen within a year' in the Hegotá fork.