What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

Ethereum has two kinds of accounts. Externally owned accounts (EOAs), the standard wallets most people use, are controlled by a private key and can do little more than send transactions. Smart contract accounts can run code, enabling features like spending limits, account recovery and paying fees in tokens other than ETH, but most users never moved to them.

EIP-7702 is an attempt to bridge that gap. Instead of asking users to migrate to new wallets, it lets existing EOAs borrow the code of a smart contract while keeping their address and funds.

This guide explains what EIP-7702 is, how it works, why developers wanted it, and how attackers used it in the largest crypto theft on record.

What is EIP-7702?

EIP-7702, titled "Set Code for EOAs," is an Ethereum Improvement Proposal written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient, according to the official specification.

It was one of the headline changes in Pectra, a major Ethereum upgrade that went live on May 7, 2025.

"EIP-7702 lays the foundation we've needed for a long time," Ethereum core developer Preston Van Loon told Decrypt at the time. "While full abstraction won't be immediately available to end users with Pectra, this upgrade gives Ethereum the infrastructure to support it moving forward."

EIP-7702 is a change to Ethereum's core protocol, not a token or a separate blockchain, so there is nothing to buy.

How does EIP-7702 work?

EIP-7702 adds a new type of Ethereum transaction, the "set code transaction." It carries a list of authorizations, each signed with the private key of the account being upgraded, that names the address of a smart contract the account wants to use.

Once the transaction is processed, the account stores a small pointer, called a delegation indicator, to that contract. From then on, whenever anyone calls the account, Ethereum runs the contract's code as if it belonged to the account, with full access to its funds.

The delegation lasts until the account owner signs a new authorization, either pointing to a different contract or clearing the pointer to restore a plain EOA.

What's so special about EIP-7702?

The specification names three main features it was designed to deliver:

• Batching: combining several actions, such as approving a token and then swapping it, into a single transaction.
• Sponsorship: letting another account, such as an app, pay transaction fees on a user's behalf, with the user possibly reimbursing it in another token.
• Privilege de-escalation: creating sub-keys with limited permissions, such as spending only a certain token or only 1% of a balance per day.

The security risks

Those same features carry risks. Because delegated code gets "unrestricted access to the account," apps should never ask users to sign an EIP-7702 authorization, and wallets should not offer an interface for it, the specification warns. "There is no safe way to provide this interface," it says.

Scammers moved quickly. Within weeks of Pectra's launch, trading firm Wintermute found that more than 80% of EIP-7702 delegations pointed to copies of the same malicious "sweeper" contract, which automatically drains wallets whose keys have leaked, The Block reported in June 2025.

EIP-7702 and the Binance hack

On October 29, 2026, an attacker moved some $6.4 billion out of Binance wallets on 10 blockchains, most of it within about 20 minutes. Blockchain analytics firms TRM Labs and Chainalysis both attributed the theft to TraderTraitor, the North Korean hacking group behind the $1.5 billion Bybit hack in February 2025.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 authorizations signed in advance, according to TRM Labs. An operational wallet funded through crypto mixer Tornado Cash submitted the signed authorizations, which let the hot wallet run attacker-deployed code, and the attacker then called the wallet to sweep its assets into addresses it controlled, Chainalysis said.

Crucially, EIP-7702 delegations require a valid signature from the account being upgraded. Binance wallets on the other nine chains also sent funds to the attacker through ordinary signed transfers, which TRM said points to a compromise of Binance's hot wallet signing infrastructure rather than a flaw in Ethereum itself.

Binance has said its investigation began with a compromised engineer's laptop, and has since found "additional points of breach."

The future of EIP-7702

EIP-7702 is a first step toward full account abstraction, a long-standing goal of making every Ethereum account as flexible as a smart contract. Its authors designed it to be forward-compatible with that "endgame," so wallets built on it today should keep working as Ethereum's account model evolves.

The next step could come with Hegotá, the upgrade planned to follow Glamsterdam on Ethereum's roadmap. In February 2026, Buterin said that EIP-8141, which he called "an omnibus that wraps up and solves every remaining problem" account abstraction was meant to address, looked "possible to make happen within a year" in the Hegotá fork.

"We have been talking about account abstraction ever since early 2016," Buterin wrote, adding that developers are also discussing whether existing accounts could join the new framework, which would give them batching and sponsored transactions natively.

It is part of a wider rebuild. In July 2026, Buterin described a new draft of Ethereum's long-term roadmap as the network's biggest overhaul since the Merge, its 2022 switch to proof of stake.