Did Ethereum EIP-7702 Cause the Binance Hack? What Security Experts Say
Experts say EIP-7702 did not cause the $6.3B Binance hack, but it may have made the theft faster. Here is what it is and how to stay safe.
Binance confirmed on Friday that it suffered a record $6.3 billion hack, and a technical question followed quickly: did an Ethereum upgrade called EIP-7702 make it possible? Security experts who have examined the attack say no. The upgrade did not cause the breach, but it may have helped the attackers move funds faster.
Our earlier report on the Binance hack covered the scale of the theft and the link to North Korea’s TraderTraitor unit. This article looks at the technical debate and what it means for wallet owners.
What is EIP-7702?
EIP-7702 is an Ethereum upgrade introduced in May 2025 as part of the Pectra update. It lets an ordinary wallet use smart-contract features, such as bundling several actions into one transaction and having someone else pay the gas fees.
It works through a “delegation”: the wallet owner signs an authorization that attaches contract code to their account. That code can then act on the account until the owner removes it. Because the delegation covers the whole account, a bad one can do far more damage than a single token approval.
What security experts say about the Binance hack
Blockaid, a blockchain security firm, says compromised signing systems most likely enabled the attack. Its CEO, Ido Ben-Natan, told Cointelegraph that the attackers could have stolen the funds without EIP-7702. In his view, the upgrade gave them a way to do it in one sweep and possibly bypass some checks, whereas they would otherwise have needed many separate transactions.
Ivo Georgiev, CEO of wallet provider Ambire, reached a similar conclusion. He said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.
Binance’s own account of the breach has also changed. The exchange first suspected a compromised laptop belonging to one of its engineers, then said it had found additional points of breach. CEO Richard Teng said investigators had found no evidence that wallet private keys leaked. Ben-Natan’s reading is that attackers reached the infrastructure that signs transactions for one of Binance’s hot wallets, and that the signer approved a transaction it should not have.
Why the upgrade still matters
Even if EIP-7702 was not the cause, its risks were known before this attack:
- May 2025: trading firm Wintermute reported that most early EIP-7702 delegations pointed to malicious contracts designed to drain compromised wallets automatically.
- September 2025: holders of World Liberty Financial (WLFI) tokens reported losses linked to malicious EIP-7702 delegations.
- After the Binance hack: some Ethereum community members described the upgrade as a convenient tool for sweeping funds out of a wallet once an attacker is in control.
Georgiev also warned that engineers regaining control of a compromised system can overlook the need to revoke a malicious delegation, and that the feature is still poorly understood.
What wallet owners can do
- If you keep funds on an exchange: follow the exchange’s official notices, withdrawal status, and the post-mortem it has promised. Binance has said it will cover all losses.
- If you hold your own keys: EIP-7702 only affects you if you signed a delegation. Block explorers such as Etherscan can show whether your address has one.
- Approve only vetted contracts: the Security Alliance advises approving delegations only to contracts that your wallet provider has vetted and built in.
- Know how to undo one: you can remove a delegation by signing a new authorization that points to the zero address. If you do not remember signing a delegation, treat the wallet as compromised and move your funds to a new one.
- Remember approvals: removing a delegation does not cancel token approvals, so review those separately.
This is general information, not personal security advice. Check your wallet provider’s own guidance before acting.
I want to speak to you directly about what happened.Bottom line – your money is safe, and we’re covering every loss.Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.So far, we have found no evidence of any wallet private key leak.We’ll share a detailed technical post-mortem once the investigation is complete and every fact is verified – and publish an updated Proof of Reserves once remediation is complete.What you need to know: • Your funds are safe • Binance will cover all losses from the SAFU fund and company funds • Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners • No evidence of any wallet private key leak • Deposits are unaffected and operating as normalWhat we’ve done: • Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses • Revoked the affected address authorizations • Engaged law enforcement and blockchain intelligence partners to trace and recover fundsOur team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately – and I’ll share what I can, as soon as I can.
— Richard Teng (@_RichardTeng) October 30, 2026
What exchanges can learn
The main lesson is that the weak point moved from smart-contract code to the systems around it. Ben-Natan warned that similar attacks on signing systems threaten other exchanges, and said simulating transactions before they are approved could help catch malicious requests. For readers following the aftermath, see our full report on how the hack unfolded and where the stolen funds went.
Sources
