EIP-7702 explained: the Ethereum upgrade caught up in the Binance hack

An Ethereum upgrade designed to make everyday wallets more useful has been pulled into the investigation of Binance’s $6.3 billion hack. Security experts are split on how much it mattered, but agree it was part of how the attacker moved funds.

What happened

Binance chief executive Richard Teng said the attacker used a self-destruct mechanism and an EIP-7702 delegation that bypassed the exchange’s normal approval controls. On Ethereum, the attacker was reportedly armed with 50 signatures from Binance’s own wallet.

Several security experts said the attackers could have drained Binance’s wallets without EIP-7702. Their view is that the upgrade did not cause the breach but may have amplified the losses by helping the attacker get around withdrawal safeguards.

Background

EIP-7702 arrived on Ethereum in 2025. It lets an ordinary wallet, controlled by a single private key, temporarily run smart contract code. That makes features such as batched transactions, where several actions happen in one step, and sponsored transactions, where someone else pays the fees, available to normal users.

The trade-off is that a wallet can delegate its behaviour to a piece of code. If an attacker controls the keys or signatures, that delegation can be used to execute many actions at once, faster than human reviewers or automated limits might react.

Why it matters

Upgrades like EIP-7702 are meant to make crypto easier to use. The Binance case shows that every new capability also changes the security assumptions of the large custodians that hold user funds.

Expect exchanges and wallet providers to review how their approval systems handle delegated code, and expect debate over whether the upgrade needs extra guardrails or whether the real failure lay in how Binance’s signatures were exposed.