An Ethereum feature designed to make ordinary crypto wallets more flexible was used in the October theft of about $6.4 billion from Binance wallets, highlighting the security trade-offs involved in giving standard accounts smart-contract capabilities.
According to Decrypt, the attacker used EIP-7702 on Ethereum to turn a Binance hot wallet into a wallet controlled by malicious code. Blockchain analytics firms attributed the broader operation to TraderTraitor, a North Korean hacking group previously linked to the $1.5 billion Bybit theft.
What EIP-7702 changes
EIP-7702 is an Ethereum protocol upgrade rather than a token, investment product or separate blockchain. It was proposed in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient. The proposal became part of Ethereum’s Pectra upgrade, which went live on May 7, 2025.
The feature addresses a long-standing difference between two types of Ethereum accounts. Externally owned accounts, or EOAs, are the standard wallets controlled by private keys. They can sign and send transactions, but they do not natively run application code. Smart-contract accounts, by contrast, can support functions such as spending limits, account recovery and payment of transaction fees with tokens other than ETH.
EIP-7702 allows an existing EOA to temporarily use the code of a smart contract without moving its address or assets to a new wallet. This was intended to make advanced wallet functions available without requiring users to migrate to a different account type.
Technically, the upgrade introduced a new “set code” transaction. The wallet owner signs an authorization naming the smart-contract address whose code the account will use. Ethereum then stores a delegation indicator. When the account is called, the network executes the delegated contract code as though it belonged to the wallet.
The arrangement can be removed or changed when the owner signs another authorization. However, delegated code has full access to the account’s funds, making the authorization a highly sensitive permission.
The benefits and the risks
EIP-7702 was designed to support several features that could make Ethereum wallets easier to use:
- Batching multiple actions, such as approving a token and completing a swap, in one transaction.
- Sponsorship, allowing an application or another account to pay a user’s transaction fees, potentially with reimbursement in another token.
- Limited-permission keys, which could restrict a sub-key to a particular asset or to a defined spending amount.
These capabilities are part of the broader effort known as account abstraction: making Ethereum accounts operate with some of the flexibility traditionally associated with smart contracts.
The same flexibility creates a security concern. The EIP-7702 specification warns that applications should not ask users to sign such authorizations and says wallets should not provide an interface for doing so, because delegated code can access the account without restriction.
Misuse appeared soon after the Pectra upgrade. Trading firm Wintermute found that more than 80% of EIP-7702 delegations were pointing to copies of the same malicious “sweeper” contract, The Block reported in June 2025. Such contracts can automatically move assets from wallets whose private keys or authorizations have been compromised.
How the Binance theft unfolded
On October 29, 2026, an attacker moved approximately $6.4 billion from Binance wallets across 10 blockchains, with most of the transfers taking place in roughly 20 minutes. TRM Labs and Chainalysis both attributed the incident to TraderTraitor.
On Ethereum, TRM Labs said the attacker used an EIP-7702 delegation to convert a Binance hot wallet into a sweeper controlled by the attacker. The wallet had 50 authorizations signed in advance. Chainalysis reported that an operational wallet funded through the crypto mixer Tornado Cash submitted those authorizations, enabling the hot wallet to execute code deployed by the attacker. The attacker then called the wallet and moved its assets to addresses under their control.
EIP-7702 itself still requires a valid signature from the account being delegated. That detail is important to the interpretation of the incident. Binance wallets on the other nine affected chains transferred funds through ordinary signed transactions, and TRM Labs said the pattern indicated a compromise of Binance’s hot-wallet signing infrastructure rather than a defect in Ethereum’s underlying protocol.
Binance said its investigation started with a compromised engineer’s laptop and later identified “additional points of breach.”
Ethereum and crypto market picture
Moneyiar market data at 12:48-12:49 on November 1, 2026, showed Ethereum at $2,259.2320424883, up 0.48% over 24 hours but down 3.07% over seven days. BNB was at $711.7068665596, up 0.93% in 24 hours and down 3.7% over seven days.
The same data showed Shiba Inu at $0.0000046853, down 0.63% in 24 hours and 3.52% over seven days. Uniswap was priced at $7.2331127988, rising 3.53% over 24 hours and 7.85% over seven days.
What comes next for EIP-7702
EIP-7702 is intended as an interim step toward a more flexible Ethereum account system. Its authors designed it to remain compatible with the network’s longer-term account-abstraction plans, meaning wallets using the feature could continue to function as Ethereum’s account model develops.
Ethereum’s roadmap may advance that work through future upgrades. Buterin said in February 2026 that EIP-8141, a proposal intended to address remaining account-abstraction issues, could be achievable within a year in the planned Hegotá fork, which is expected to follow Glamsterdam.
The Binance incident does not show that EIP-7702 can operate without authorization. Instead, it demonstrates the consequences when valid wallet permissions or signing infrastructure are compromised: a feature designed to expand what a wallet can do can also give malicious code broad control over its assets.
