The EIP-7702 Binance hack has pushed an obscure Ethereum feature into the headlines. On October 29, 2026, an attacker used it to point one of Binance’s hot wallets at a malicious smart contract during a theft that analysts value at up to $6.4 billion. EIP-7702 isn’t a token: it’s a protocol change, live since May 2025, that lets ordinary wallets borrow smart contract code, and Decrypt’s explainer shows why that power cuts both ways.
- EIP-7702, titled “Set Code for EOAs,” went live with Ethereum’s Pectra upgrade on May 7, 2025.
- Every delegation must be signed with the private key of the wallet being changed, so the feature can’t be triggered without key access.
- Estimates of the theft run from about $6.3 billion to about $6.4 billion (Chainalysis), with TRM Labs putting it at about $6.36 billion.
- CCN reports roughly $3.66 billion moved without EIP-7702, through ordinary transfers and withdrawals on other chains.
- Binance says it will cover all losses and has set aside about $6.34 billion of company funds.
Timeline of the EIP-7702 Binance hack
- May 2024: Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient write the EIP-7702 specification.
- February 2025: Bybit loses $1.5 billion, then the largest crypto theft on record. The FBI blamed a North Korea-linked group.
- May 7, 2025: Pectra activates on Ethereum mainnet, bringing EIP-7702 with it.
- June 2025: The Block reports Wintermute’s finding that more than 80% of EIP-7702 delegations point to copies of one malicious “sweeper” contract.
- October 29, 2026, around 20:20 UTC (4:20pm ET): Funds start leaving Binance hot wallets on multiple blockchains, according to Chainalysis.
- October 29, 2026, 20:20:59 UTC: The attacker sends one Ethereum transaction carrying 50 EIP-7702 authorizations aimed at the “Binance 14” hot wallet. Only one succeeds.
- October 30, 2026, 12:30am ET: Chainalysis attributes the theft to North Korea’s TraderTraitor group.
- October 30, 2026: Binance’s update says investigators suspect entry through a DevOps engineer’s laptop.
How EIP-7702 works and why developers wanted it
Ethereum has two account types. Externally owned accounts, the standard wallets most people use, are controlled by a private key and can do little beyond sending transactions. Smart contract accounts can run code for spending limits, recovery or paying fees in tokens other than ETH. Most users never switched.
EIP-7702 bridges that gap. It adds a “set code transaction” that carries signed authorizations naming a contract. Once processed, the wallet stores a small pointer, the delegation indicator, and Ethereum runs that contract’s code whenever the account is called, with full access to its funds. The pointer stays until the owner signs a new authorization.
The specification lists three goals: batching several actions into one transaction, letting apps sponsor gas fees, and creating limited-permission sub-keys. “EIP-7702 lays the foundation we’ve needed for a long time,” core developer Preston Van Loon told Decrypt around the Pectra launch.
The warning built into the spec
The authors flagged the danger themselves. Because delegated code gets “unrestricted access to the account,” apps shouldn’t ask users to sign these authorizations and wallets shouldn’t offer an interface for it. “There is no safe way to provide this interface,” the document says. Scammers proved the point within weeks, using sweeper contracts to empty wallets whose keys had leaked.
What investigators and outlets are saying
Blockaid’s on-chain analysis, detailed by crypto.news, shows the single successful authorization repointed Binance 14 to a malicious contract. Blockaid says the transfers included 167,464 ETH and more than 1.6 billion USDT. For a step-by-step account of the drain, see our breakdown of how the Binance hack happened.
But the EIP-7702 Binance hack wasn’t only about EIP-7702. Chainalysis notes that one wallet was drained through a delegated sweep while others sent funds through ordinary signed transfers. CCN reports that about $3.66 billion of the roughly $6.3 billion left without the feature. Both routes required signing access. Binance said its initial investigation pointed to an engineer’s laptop, which, as CNN reported, let the attacker reach a service container and submit unauthorized withdrawal transactions.
TRM Labs and Chainalysis both name TraderTraitor, the group the FBI tied to Bybit. TRM Labs estimated, according to CNBC, that about $6.36 billion left Binance wallets across 10 blockchains, most of it within about 20 minutes. Our report on the TraderTraitor attribution by TRM and Chainalysis covers that evidence. On recovery, Reuters reported via Yahoo Finance that Tether froze nearly $1.57 billion and Circle more than $800 million. Binance said $3 billion had been “frozen on-chain so far.”
Prices slipped. As of 15:13 UTC on October 30, CoinGecko data showed the following, and the Crypto Fear & Greed Index read 30 (“Fear”) that day. Our coverage of the liquidations and wider market impact has more.
| Asset | Price (USD) | 24h change | 7d change |
|---|---|---|---|
| Bitcoin (BTC) | $77,525 | -4.76% | -5.9% |
| Ethereum (ETH) | $2,248.91 | -4.71% | -7.37% |
| BNB | $703.07 | -6.39% | -6.68% |
What to watch next
Binance suspended customer withdrawals, and CEO Yi He said they should resume by Sunday. Binance has 335 million registered users, according to Yahoo Finance, so whether that timeline holds is the near-term test. Further freezes, laundering routes and any revision to the loss figure are also worth watching.
For Ethereum, the open question is whether wallet providers and custodians tighten how they handle EIP-7702 authorizations. Funds held on any exchange carry counterparty and security risk, and anyone holding a leaked key can move a wallet’s funds, whatever the protocol design.
FAQ about the EIP-7702 Binance hack
What is EIP-7702?
It’s an Ethereum protocol change, activated in the May 2025 Pectra upgrade, that lets a standard wallet delegate to smart contract code while keeping its address and funds. There’s nothing to buy.
Was the EIP-7702 Binance hack a flaw in Ethereum itself?
Evidence so far points to compromised signing access. Each authorization needs the wallet’s own key, Binance’s initial investigation links entry to an engineer’s laptop, and CCN reports about $3.66 billion moved without EIP-7702.
Who is blamed for the theft?
TRM Labs and Chainalysis attribute it to TraderTraitor, a North Korean hacking group.
Sources
- What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack (Decrypt)
- Binance hack: How one wallet trick led to a $6.3 billion breach (crypto.news)
- Binance Hack Exposes EIP-7702 Wallet Risk in USD 6.3B Breach (www.analyticsinsight.net)
- Binance crypto hack: North Korea suspected to be behind biggest-ever heist (www.cnn.com)
- The $6.4 Billion Binance Exploit: Tracing the North Korea … (www.chainalysis.com)
- Ethereum's EIP-7702 Blamed for Binance's $6.3B Hack, but $3.66B Was Stolen Without It (www.ccn.com)
- Hackers steal $6.3 billion from Binance in record heist blamed on North Korea (finance.yahoo.com)
- Binance hit by record $6.3 billion crypto hack, likely linked to North Korea (finance.yahoo.com)
- Binance's $6.3 billion hack: What we know and what comes next (www.cnbc.com)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
