Quick answer: EIP-7702 did not cause the Binance hack of Oct. 29, 2026, but it sped it up. Per Blockaid, one of 50 pre-signed EIP-7702 authorizations turned the Binance 14 hot wallet into a sweeper that moved about $2.5 billion in minutes. TRM Labs and Blockaid say the root cause was compromised signing systems.
The EIP-7702 Binance hack debate has a clear answer so far: Ethereum’s delegation feature did not open the door, but it made the theft much faster. Security firms say the attacker already had signing access to a Binance hot wallet on Oct. 29, 2026, and EIP-7702 let them empty it in one sweep.
That distinction matters for every Ethereum user. In addition, the debate has now reached figures such as Cardano founder Charles Hoskinson.
What happened in the EIP-7702 Binance hack?
According to Blockaid, as reported by crypto.news, a transaction landed at 20:20:59 UTC on Oct. 29. It carried 50 EIP-7702 authorizations aimed at Binance 14, one of the exchange’s busiest Ethereum hot wallets.
However, each authorization must match the wallet’s nonce, a counter that rises with every transaction. Because Binance 14 was processing withdrawals, its nonce kept moving. So the attacker signed 50 consecutive values, from 18,914,775 to 18,914,824, to make sure one would hit.
One did. As a result, it pointed the wallet to an unverified contract with a sweep() function. Then, at about 20:24 UTC, the wallet was drained of roughly $2.5 billion. The haul included 167,464 ETH and more than 1.6 billion USDT, per the same Blockaid data.
For the wider attack, which Binance puts at about $6.3 billion, see our report on the North Korea link to the Binance hack.
Did EIP-7702 cause the Binance hack?
No, and most experts agree on that point. Decrypt notes that every EIP-7702 delegation needs a valid signature from the account itself. Meanwhile, Binance wallets on nine other chains were drained through ordinary signed transfers, which TRM Labs said points to a compromise of Binance’s signing systems, not a flaw in Ethereum.
Blockaid CEO Ido Ben-Natan told Cointelegraph the attacker could have stolen the funds without the feature. “The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,” he said.
Similarly, Ivo Georgiev, CEO of wallet maker Ambire, played down the feature’s role. He said it made little difference, because the hackers could already authorize transactions. However, he warned that engineers may forget to revoke a malicious delegation after regaining control. “This is a problem with EIP 7702, it’s just very, very poorly understood,” he told Cointelegraph.
Why Hoskinson’s warning drew attention
On Oct. 30, Hoskinson shared an analysis by the X account CyberSatoshi with the words “Careful, there is some seriously dangerous code out there,” crypto.news reported.
CyberSatoshi’s reconstruction claims the sweeper was built for Binance’s setup. For example, it left exactly 1 ETH behind, which the poster argues kept the exchange’s withdrawal queue from failing and raising alarms. It also claims that a custom function reached an outside vault holding $823 million in USDC. However, these are one analyst’s claims, and Binance has not confirmed them.
Still, the core point holds up against the official spec. In fact, delegated code gets full control of the account, and the delegation stays in place until someone clears it.
EIP-7702 data and context
EIP-7702, “Set Code for EOAs,” was written in May 2024 by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient. It went live with the Pectra upgrade on May 7, 2025. At first, the goal was simple: let normal wallets batch actions and use sponsored gas without moving to a new address.
Even so, the risks were known early. For instance, the EIP-7702 specification warns that wallets should not offer apps a way to request these signatures, because “there is no safe way to provide this interface.” Within weeks of launch, Wintermute found that more than 80% of delegations pointed to copies of one malicious sweeper contract, Decrypt reported.
Here is how the market looked at 07:50 UTC on Oct. 31, 2026, per CoinGecko:
| Asset | Price (USD) | 24h change |
|---|---|---|
| Ether (ETH) | $2,239.99 | +0.4% |
| BNB | $699.29 | -1.0% |
| Bitcoin (BTC) | $77,252 | -1.1% |
In short, ether has steadied even as the debate grows.
What to watch next after the EIP-7702 Binance hack
First, watch Binance’s own findings. The exchange said it found no evidence of leaked private keys and has revoked the affected authorization. It expects more technical details within about 48 hours of its Oct. 30 update, per crypto.news.
Second, watch withdrawals. Binance said it aims to start a staged restart within about 34 hours of that update, which CoinDesk framed as a Sunday target. A proof-of-reserves report is due by Monday, Nov. 2. Our earlier piece tracks the billions already frozen.
Third, watch wallet rules. We expect exchanges and custodians to add checks that flag any EIP-7702 authorization from hot wallets.
For self-custody users, the lesson is the same as with the recent Trezor Safe 5 implant warning: never sign what you cannot read.
EIP-7702 Binance Hack FAQ
What is EIP-7702?
EIP-7702 is an Ethereum feature, live since the Pectra upgrade on May 7, 2025, that lets a normal wallet delegate its actions to smart contract code. The delegated code gets full access to the wallet’s funds.
Was Ethereum hacked in the Binance breach?
No. Blockaid and TRM Labs say the attacker had compromised Binance’s signing systems. EIP-7702 delegations need a valid signature from the account, and Binance wallets on nine other chains were drained with ordinary signed transfers.
How much was taken from the Binance 14 wallet?
About $2.5 billion, including 167,464 ETH and more than 1.6 billion USDT, at around 20:24 UTC on Oct. 29, 2026, according to Blockaid data reported by crypto.news.
How can I check my wallet for EIP-7702 risks?
Never sign an authorization request you do not understand. Wallets and block explorers can show whether an address has a delegation set. You can remove one by signing a new authorization that points to the zero address.
Not financial advice. Always do your own research (DYOR) before moving funds.
Sources
- crypto.news: Binance hack exposes EIP-7702 wallet attack (Blockaid data)
- Cointelegraph: EIP-7702 didn’t cause Binance hack, but may have amplified losses
- Decrypt: What is EIP-7702? The Ethereum upgrade behind the Binance hack
- crypto.news: Hoskinson flags Binance sweeper code as EIP-7702 debate grows
- crypto.news: Binance reserves $6.34B after hack, targets phased withdrawals
- CoinDesk: Binance uncovers wider breach, targets Sunday withdrawal restart
- Ethereum EIPs: EIP-7702 Set Code for EOAs
