EIP-7702 didn’t cause Binance hack, but may have amplified losses

Compromised signing systems likely enabled Binance’s $6.3 billion hack, while Ethereum’s EIP-7702 upgrade may have helped attackers bypass security checks, according to blockchain security firm Blockaid.

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,” Ben-Natan said, explaining that attackers otherwise would have needed multiple transactions.

Binance confirmed Friday that it had suffered a $6.3 billion hack, the largest in crypto history, and pledged to cover all losses. The exchange said it uncovered additional points of breach after initially suspecting a compromised laptop belonging to one of its engineers.

Ethereum introduced Ethereum Improvement Proposal 7702 (EIP-7702) in May 2025 as part of its Pectra upgrade, allowing ordinary wallets to use smart-contract features such as bundled transactions and sponsored gas fees.

Security concerns emerged within weeks. In May 2025, crypto trading firm Wintermute reported that most early EIP-7702 delegations pointed to malicious contracts designed to automatically drain compromised wallets.

The risks resurfaced in September 2025, when holders of World Liberty Financial (WLFI) tokens reported losses linked to malicious EIP-7702 delegations.

Ethereum community member VEER cited security warnings raised during discussions of EIP-7702 in 2024.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

Binance CEO Richard Teng said investigators had found no evidence that wallet private keys had leaked.

Ben-Natan said attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.

“Eventually they got to a position where they could propose transactions to what is most likely a very secure signer that has custody of one of Binance’s hot wallets,” he said. “The takeaway is that ultimately the signer signed a transaction that they shouldn’t have,” he said.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

He said attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

“This is a problem with EIP 7702, it’s just very very poorly understood,” Georgiev said.

Ben-Natan warned that similar signing-system attacks threaten other exchanges and said transaction simulation could help detect malicious requests before they receive approval.