EIP-7702 Used in $6.4B Binance Hack

On October 29, 2026, an attacker moved approximately $6.4 billion from Binance wallets across ten blockchains. The theft was attributed to TraderTraitor, a North Korean hacking group, by blockchain analytics firms TRM Labs and Chainalysis. The attacker utilized EIP-7702, an Ethereum upgrade activated in May 2025, to turn a Binance hot wallet into a malicious sweeper contract. This was achieved using fifty authorizations signed in advance, which allowed the hot wallet to execute attacker-deployed code with full access to funds.

EIP-7702, written by Vitalik Buterin and other developers in May 2024, allows standard wallets to temporarily assume smart contract abilities. It introduces a new transaction type that stores a delegation indicator, marked by the byte 0xef, enabling unrestricted access to account funds. The specification warns that there is no safe interface for this feature due to the unrestricted nature of delegated code. Within weeks of the upgrade's launch, over 80% of delegations pointed to malicious sweeper contracts.

Binance stated its investigation began with a compromised engineer's laptop and identified additional breach points. Funds on nine other chains were moved via ordinary signed transfers, indicating a compromise of Binance's signing infrastructure rather than a flaw in Ethereum. Vitalik Buterin noted in February 2026 that EIP-8141, an omnibus for account abstraction, could be implemented within a year in the Hegotá fork.