What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

What it is

EIP-7702 ("Set Code for EOAs") is the Ethereum change that went live with Pectra on 7 May 2025. It was written in May 2024 by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient. It lets an ordinary wallet (EOA) point to smart contract code while keeping its address and funds. The page also covers the 29 October 2026 Binance theft of about $6.4 billion across 10 blockchains, most of it within about 20 minutes.

How it works

A new "set code transaction" carries a list of authorizations. The account's private key signs each one, and each names a contract address. Once processed, the account stores a delegation indicator, a pointer to that contract. The pointer is marked with the byte 0xef, which earlier upgrades banned so it could be reserved for this. After that, any call to the account runs the contract's code with full access to its funds.

The delegation lasts until the owner signs a new authorization. That authorization can point elsewhere or clear the pointer to restore a plain EOA.

In the Binance attack on Ethereum, per TRM Labs, the attacker used 50 authorizations signed in advance. Chainalysis says an operational wallet funded through Tornado Cash submitted them, which let the hot wallet run attacker-deployed code. The attacker then called the wallet to sweep its assets to attacker-controlled addresses.

Preconditions / Affected

Every delegation needs a valid signature from the account being upgraded. The attack therefore required control of the hot wallet's signing capability. Binance wallets on the other nine chains also sent funds out through ordinary signed transfers. TRM says this points to a compromise of Binance's hot wallet signing infrastructure, not a flaw in Ethereum. Binance says its investigation began with a compromised engineer's laptop, and it has since found "additional points of breach."

What to do

The page gives guidance, not commands:

• The specification says apps should never ask users to sign an EIP-7702 authorization, and wallets should not offer an interface for it. It states: "There is no safe way to provide this interface."
• Delegated code gets "unrestricted access to the account," so treat any signed authorization as full custody transfer.
• To undo a delegation, sign a new authorization that clears the pointer.
• Delegated accounts can be recognized by the 0xef marker in their code.

Caveats

• Wintermute found that more than 80% of EIP-7702 delegations, within weeks of Pectra, pointed to copies of one malicious sweeper contract (The Block, June 2025). Such sweepers drain wallets whose keys have leaked.
• Attribution of the Binance theft to North Korea's TraderTraitor comes from TRM Labs and Chainalysis. The group also carried out the $1.5 billion Bybit hack in February 2025.
• The page gives no detection queries, contract addresses or hardening steps for custodians.
• Buterin said in February 2026 that EIP-8141, an account abstraction proposal, looked "possible to make happen within a year" in the Hegotá fork. That is his forecast, not a scheduled change.