What is EIP-7702? The Ethereum upgrade at the center of the $6.4 billion Binance hack

Ethereum upgrade linked to the largest crypto theft on record

EIP-7702 is an Ethereum upgrade, activated in May 2025, that lets standard wallets temporarily act like smart contracts. In October 2026, an attacker used it during a $6.4 billion hack of Binance, an event analysts attributed to North Korea. This explainer covers what the upgrade does, why it was created, and how it was used in the theft.

Key points at a glance

• EIP-7702 went live on May 7, 2025, as part of Ethereum's Pectra upgrade.
• It lets standard Ethereum wallets borrow the code of a smart contract while keeping their own address and funds.
• Delegated code gets full access to the wallet's funds, which the official specification warns creates serious risks.
• On October 29, 2026, an attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper and drain roughly $6.4 billion across 10 blockchains.
• Analytics firms TRM Labs and Chainalysis both attributed the theft to TraderTraitor, the North Korean hacking group behind the $1.5 billion Bybit hack in February 2025.

What EIP-7702 actually does

Ethereum has two kinds of accounts. Most people use externally owned accounts, or EOAs — the standard wallets controlled by a private key, a secret code that proves ownership. These wallets can send transactions but can do little else. Smart contract accounts can run code, which allows features like spending limits, account recovery, and paying fees in tokens other than ETH. Most users, however, never moved to them.

EIP-7702, titled "Set Code for EOAs," is meant to bridge that gap. Written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient, it lets existing wallets borrow smart contract code without migrating to a new address. It is a change to Ethereum's core protocol, not a token or separate blockchain, so there is nothing to buy.

"EIP-7702 lays the foundation we've needed for a long time," Ethereum core developer Preston Van Loon told Decrypt at the time of launch. "While full abstraction won't be immediately available to end users with Pectra, this upgrade gives Ethereum the infrastructure to support it moving forward."

How the 'set code transaction' works

EIP-7702 adds a new type of transaction that carries a list of authorizations. Each authorization is signed with the private key of the account being upgraded and names the smart contract that account wants to use.

Once processed, the account stores a small pointer, called a delegation indicator, to that contract. When anyone calls the account, Ethereum runs the contract's code as if it belonged to the account — with full access to its funds. The delegation lasts until the owner signs a new authorization pointing to a different contract or clears the pointer.

Delegated accounts are marked using the byte 0xef, a code value that was banned in earlier upgrades and reserved for purposes like this.

The three features it was designed for

According to the specification, EIP-7702 was built to deliver three things:

• Batching: combining several actions, such as approving a token and then swapping it, into a single transaction.
• Sponsorship: letting another account, such as an app, pay a user's transaction fees, with the user possibly reimbursing it in another token.
• Privilege de-escalation: creating sub-keys with limited permissions, such as spending only a certain token or only 1% of a balance per day.

The warning about unrestricted access

Because delegated code gets unrestricted access to the account, the specification warns that apps should never ask users to sign an EIP-7702 authorization, and wallets should not offer an interface for it. "There is no safe way to provide this interface," it says.

Scammers moved quickly after launch. In June 2025, trading firm Wintermute found that more than 80% of EIP-7702 delegations pointed to copies of the same malicious "sweeper" contract — a contract that automatically drains wallets whose keys have leaked — The Block reported.

How the attacker used it in the Binance hack

On October 29, 2026, an attacker moved some $6.4 billion out of Binance wallets on 10 blockchains, most of it within about 20 minutes. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet — an exchange wallet connected to the internet for handling customer withdrawals — into a sweeper it controlled, with 50 authorizations signed in advance, according to TRM Labs.

Chainalysis reported that an operational wallet funded through Tornado Cash, a service that mixes crypto to hide its origin, submitted the signed authorizations. That let the hot wallet run attacker-deployed code, and the attacker then called the wallet to sweep its assets into addresses it controlled.

A flaw in Ethereum or a breach at Binance?

The two analytics firms point to the same conclusion: the problem was Binance's signing infrastructure, not Ethereum. EIP-7702 delegations require a valid signature from the account being upgraded. Binance wallets on the other nine chains also sent funds to the attacker through ordinary signed transfers, which TRM said points to a compromise of Binance's hot wallet signing setup rather than a flaw in Ethereum itself.

Binance has said its investigation began with a compromised engineer's laptop, and has since found "additional points of breach."

What comes after EIP-7702

EIP-7702 is a first step toward full account abstraction — a long-standing goal of making every Ethereum account as flexible as a smart contract. Its authors designed it to be forward-compatible with that "endgame," so wallets built on it should keep working as Ethereum's account model evolves.

The next step could come with Hegotá, the upgrade planned to follow Glamsterdam on Ethereum's roadmap. In February 2026, Buterin said that EIP-8141, which he called "an omnibus that wraps up and solves every remaining problem" account abstraction was meant to address, looked "possible to make happen within a year" in the Hegotá fork. He noted that developers are also discussing whether existing accounts could join the new framework, which would give them batching and sponsored transactions natively.

The wider roadmap is also being rebuilt. In July 2026, Buterin described a new draft of Ethereum's long-term roadmap as the network's biggest overhaul since the Merge, its 2022 switch to proof of stake.

What is confirmed and what is not

Confirmed: EIP-7702's launch date, its mechanics, its stated features, and the warning in its specification are all documented in the official materials and developer statements. The hack figures, the use of an EIP-7702 delegation with 50 pre-signed authorizations, and the attribution to TraderTraitor come from TRM Labs and Chainalysis, and Binance's statements about its investigation are from the company itself.

Still uncertain: the full picture of how Binance's signing infrastructure was compromised. The company has reported additional points of breach beyond the engineer's laptop, but details have not been fully disclosed.

Sources

• Decrypt