What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

What is EIP‑7702?

EIP‑7702, titled Set Code for EOAs, is an Ethereum protocol upgrade that went live in May 2025 as part of the Pectra hard‑fork. It introduces a new transaction type – the set‑code transaction – that allows an externally owned account (EOA) to point to a smart‑contract address. Once the pointer is stored, any call to the EOA executes the delegated contract’s bytecode as if it were the account itself, giving the contract full access to the account’s funds. The delegation can be cleared or redirected by the account holder with another signed set‑code transaction.

The upgrade was designed to bridge the gap between simple key‑controlled wallets and fully programmable contract accounts, enabling three core capabilities:

1. Batching – combine multiple actions (e.g., token approval + swap) into a single transaction.
2. Gas sponsorship – let a third party pay transaction fees on a user’s behalf, with optional reimbursement in non‑ETH tokens.
3. Privilege de‑escalation – create sub‑keys with limited permissions, such as spending caps or daily limits.

Because the delegated contract runs with unrestricted access, the specification explicitly warns that wallets should never expose a UI for users to sign set‑code authorizations.

---

How the Mechanism Works

1. Authorization list – The set‑code transaction carries one or more authorizations, each a signature from the EOA’s private key naming a contract address.
2. Delegation indicator – After processing, the EOA stores a single byte (0xef) pointing to the chosen contract. This byte was reserved in earlier upgrades for special purposes, making it a clear marker of delegated accounts.
3. Execution flow – Subsequent calls to the EOA trigger the delegated contract’s code. The contract can read and modify the EOA’s balance, approve tokens, or invoke any other contract function.
4. Revocation – The owner can submit a new set‑code transaction that either points to a different contract or clears the pointer, restoring the account to a plain EOA.

The design is deliberately minimal: no new token, no separate blockchain, just a protocol‑level change that any wallet can adopt.

---

Security Risks and Early Abuse

The power of EIP‑7702 is a double‑edged sword. While it enables sophisticated user experiences, it also opens a pathway for attackers to gain full control of a wallet if they obtain a valid set‑code authorization.

• Malicious delegations – Within weeks of Pectra’s launch, analytics firm The Block observed that over 80 % of new delegations referenced a handful of identical “sweeper” contracts that automatically drained any wallet whose keys were compromised.
• No safe UI – The EIP itself states there is no safe way for a wallet UI to let users sign such authorizations, because the user cannot verify what code will run on their behalf.

These warnings proved prescient when the largest crypto theft on record unfolded.

---

The $6.4 B Binance Hack and EIP‑7702

On October 29 2026, an attacker moved roughly $6.4 billion from Binance hot wallets across ten blockchains in under twenty minutes. Blockchain analytics firms TRM Labs and Chainalysis linked the theft to the North‑Korean group TraderTraitor, previously blamed for the $1.5 billion Bybit hack.

On Ethereum, the attacker leveraged an EIP‑7702 delegation:

• A compromised Binance hot wallet had previously signed 50 set‑code authorizations pointing to a malicious contract controlled by the attacker.
• An operational wallet funded through the Tornado Cash mixer submitted these signatures, activating the delegated code.
• Once active, the contract swept all ETH and ERC‑20 tokens from the hot wallet into addresses under the attacker’s control.

Other chains involved the hack used ordinary signed transfers, indicating that the breach stemmed from a broader compromise of Binance’s signing infrastructure rather than a flaw in EIP‑7702 itself. Binance’s post‑mortem cited a compromised engineer’s laptop as the initial entry point.

---

Looking Ahead: From EIP‑7702 to Full Account Abstraction

EIP‑7702 is a stepping stone toward full account abstraction, the long‑standing vision of making every Ethereum account as programmable as a smart contract. Its authors built it to be forward‑compatible, meaning wallets that adopt the delegation model should continue to function as Ethereum evolves.

The next milestone is expected in the upcoming Hegotá upgrade, slated after the Glamsterdam fork. Core developer Vitalik Buterin has hinted that EIP‑8141, an omnibus proposal that would resolve remaining abstraction challenges, could land within a year of Hegotá.

In the meantime, developers and custodians should treat EIP‑7702 delegations as high‑risk operations:

• Never request user signatures for set‑code transactions unless the user fully controls the delegated contract.
• Audit delegated contracts rigorously before allowing them to run on any wallet.
• Implement monitoring for sudden delegation changes on high‑value accounts.

---

Practical Takeaways

1. Understand the trade‑off – EIP‑7702 offers powerful UX improvements but hands over full control of a wallet to arbitrary code.
2. Secure signing infrastructure – The Binance incident underscores that compromised private keys, not the protocol itself, are the primary threat.
3. Stay informed – As Ethereum moves toward full account abstraction, keep an eye on upcoming EIPs (e.g., 8141) and upgrade timelines.

EIP‑7702 illustrates how protocol innovation can both empower users and create new attack surfaces. Proper safeguards, vigilant key management, and cautious adoption will be essential as the Ethereum ecosystem continues to evolve.