ethereum ·
Ethereum upgrade EIP-7702 linked to $6.4B Binance hack in October 2026
EIP-7702, titled "Set Code for EOAs," is an Ethereum Improvement Proposal developed in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs, and lightclient.
It was among the key changes in Pectra, a major Ethereum upgrade that became active on May 7, 2025.
This protocol allows standard Ethereum wallets, known as Externally Owned Accounts (EOAs), to temporarily execute smart contract code, thereby enabling features like batched and sponsored transactions. Previously, EOAs, controlled by private keys, could only send transactions, while smart contract accounts possessed code execution capabilities, features most users avoided.
The mechanism involves a "set code transaction," which carries authorizations signed by the account's private key, designating a smart contract address to utilize. Upon processing, the account stores a delegation indicator, causing Ethereum to run the contract's code as if it belonged to the account, granting it full access to its funds.
This delegation remains active until the account owner signs a new authorization, either pointing to a different contract or clearing the indicator to revert to a standard EOA. The specification designated this functionality using the byte 0xef, a code value previously reserved.
The specification outlines three primary features, yet it warns that these same functions introduce risks, advising that applications should never prompt users to sign an EIP-7702 authorization, as delegated code receives "unrestricted access to the account."
In October 2026, an attacker exploited EIP-7702 during a $6.4 billion theft from Binance hot wallets across 10 blockchains, which analysts linked to North Korea. TRM Labs reported that on Ethereum, the perpetrator used an EIP-7702 delegation to convert a Binance hot wallet into a controlled "sweeper" contract using 50 pre-signed authorizations.
Blockchain analytics firms noted that the operational wallet, funded via Tornado Cash, submitted the required authorizations, allowing the attacker-deployed code to sweep assets. Furthermore, TRM noted that transfers on the other nine chains pointed toward a compromise of Binance's hot wallet signing infrastructure, not an Ethereum flaw.
This development represents a foundational step toward full account abstraction, which aims to grant every Ethereum account the flexibility of a smart contract. The authors designed EIP-7702 to remain compatible with this long-term objective.
This mechanism reflects a broader institutional push toward enhancing account flexibility, a discussion dating back to early 2016, as evidenced by Vitalik Buterin's comments regarding EIP-8141 in February 2026.
Why it matters
This incident highlights the significant security risks introduced by EIP-7702's delegated access, even when the protocol itself is not flawed. Regulators and exchanges must closely watch how wallet interfaces handle these delegations to prevent similar exploits targeting hot wallet infrastructure.
