ethereum ·
Ethereum EIP-7702 enables smart contract code in wallets, linked to $6.4B Binance hack
The mechanism enabling ordinary Ethereum wallets to execute smart contract logic, thereby supporting both sponsored and batched transactions, is detailed by EIP-7702.
EIP-7702, formally titled "Set Code for EOAs," originated as an Ethereum Improvement Proposal in May 2024. It was authored by Ethereum co-founder Vitalik Buterin alongside developers Sam Wilson, Ansgar Dietrichs, and lightclient, according to the official specification. This proposal represented one of the significant alterations introduced during Pectra, a major Ethereum upgrade that became operational on May 7, 2025. At the time, Ethereum core developer Preston Van Loon commented to Decrypt, stating, "EIP-7702 lays the foundation we've needed for a long time," further adding that "While full abstraction won't be immediately available to end users with Pectra, this upgrade gives Ethereum the infrastructure to support it moving forward."
This development constitutes a modification to Ethereum's fundamental protocol, rather than a new token or a distinct blockchain, meaning no purchase is required for it. The protocol introduces a novel transaction type known as the "set code transaction." This transaction includes a list of authorizations, each authenticated with the private key of the account undergoing the upgrade, specifying the smart contract address the account intends to utilize. Following the processing of this transaction, the account retains a small reference, termed a delegation indicator, pointing to that specific contract. Subsequently, whenever any entity interacts with the account, Ethereum executes the contract's code as if it originated from the account, granting it complete access to its assets. This delegation remains active until the account proprietor signs a subsequent authorization, either directing it toward a different contract or clearing the indicator to revert to a standard EOA. EIP-7702 utilizes the byte value 0xef to denote delegated accounts, a code value previously restricted in earlier upgrades for reserving it for specialized functions like this.
The specification outlines three principal functionalities intended by this design. However, these same features introduce associated hazards. The specification cautions that applications must never solicit users to sign an EIP-7702 authorization, and wallets should refrain from providing an interface for this, because the delegated code possesses "unrestricted access to the account," stating, "There is no safe way to provide this interface."
Market participants quickly observed vulnerabilities. In June 2025, the trading firm Wintermute reported that over 80% of the EIP-7702 delegations pointed toward replicas of a single malicious "sweeper" contract, which is designed to automatically empty wallets whose private keys have been compromised.
The implications of this technology were starkly demonstrated on October 29, 2026, when an attacker successfully moved approximately $6.4 billion from Binance wallets across ten different blockchains, with the majority of the transfer occurring within roughly twenty minutes. Blockchain analytics entities, TRM Labs and Chainalysis, both ascribed this theft to TraderTraitor, the North Korean hacking syndicate responsible for the $1.5 billion theft from Bybit in February 2025. Regarding Ethereum, TRM Labs indicated that the perpetrator leveraged an EIP-7702 delegation to transform a Binance hot wallet into a sweeper controlled by the attacker, after fifty authorizations had been signed in advance. Chainalysis noted that an operational wallet, financed via the crypto mixer Tornado Cash, submitted these signed authorizations, allowing the hot wallet to run code deployed by the attacker, after which the attacker called the wallet to siphon its holdings into addresses under their control. It is important to note that the EIP-7702 delegations mandated a valid signature originating from the account being upgraded. Furthermore, TRM observed that the funds sent to the attacker from Binance wallets on the remaining nine chains were accomplished through standard signed transfers, suggesting a compromise of Binance's hot wallet signing infrastructure rather than an inherent defect within Ethereum itself. Binance has stated that its inquiry commenced with a compromised engineer's laptop and has since uncovered "additional points of breach."
EIP-7702 represents an initial step toward achieving full account abstraction, which has been a long-standing aspiration to grant every Ethereum account the flexibility characteristic of a smart contract. Its creators engineered it to be compatible with this anticipated "endgame," meaning wallets built utilizing this feature presently should maintain functionality as the Ethereum account model evolves. The subsequent progression may arrive with Hegotá, the upgrade scheduled to follow Glamsterdam on the Ethereum roadmap. In February 2026, Buterin mentioned that EIP-8141, which he described as "an omnibus that wraps up and solves every remaining problem" concerning account abstraction, appeared "possible to make happen within a year" in the Hegotá fork.
The discussion surrounding account abstraction dates back to early 2016, referencing the original EIP-86. More recently, Buterin posted on February 28, 2026, stating, "We have been talking about account abstraction ever since early 2016," and further noting that developers are currently debating whether established accounts could integrate into the new framework, which would afford them native batching and sponsored transaction capabilities. This effort is part of a broader reconstruction initiative, with Buterin describing a new draft of Ethereum's long-term roadmap in July 2026 as the network's most significant overhaul since the Merge, the transition to proof of stake in 2022.
These protocol-level developments illustrate a continuous effort by the Ethereum community to enhance the functional capabilities of native accounts, moving towards greater abstraction and flexibility for market participants interacting with the network.
Why it matters
This incident highlights the immediate security risks associated with protocol upgrades that introduce new delegation capabilities to standard accounts. For DeFi and L2 users, understanding how these new account abstractions function is critical as they pave the way for future account flexibility on Ethereum.
