EIP-7702: Ethereum Feature Used in $6.4B Binance Hack
EIP-7702, an Ethereum upgrade activated in May 2025, lets standard wallets temporarily run smart-contract code. It enables transaction batching, gas sponsorship and limited-permission keys, but delegated code can access the wallet’s funds.
On October 29, 2026, attackers stole about $6.4 billion from Binance wallets across 10 blockchains. TRM Labs and Chainalysis attributed the theft to TraderTraitor, a North Korean hacking group. On Ethereum, the attacker reportedly used 50 pre-signed EIP-7702 authorizations to turn a Binance hot wallet into a sweeper and transfer assets to attacker-controlled addresses.
The incident does not indicate a flaw in Ethereum itself: EIP-7702 requires a valid authorization signature from the account owner. Binance said its investigation found a compromised engineer’s laptop and additional breach points. The episode highlights the security risks of EIP-7702 delegation and the importance of protecting exchange wallet-signing systems.
Bearish
The news is bearish for near-term sentiment because the reported $6.4 billion theft raises concerns about exchange security and the risks of delegated wallet permissions. Traders may respond with increased caution around centralized exchanges, monitor Binance-related flows and spreads, and seek safer custody options. Such reactions can add short-term volatility to exchange-linked assets and the wider crypto market, particularly if further details point to continuing breaches or disruptions.
The incident should not, however, be read as evidence that Ethereum or EIP-7702 itself was exploited through a protocol bug. The account must authorize a delegation with a valid signature, and the article says Binance’s wallets on other chains also sent funds through signed transfers. That points to a compromise of wallet-signing infrastructure. This distinction may limit sustained selling of ETH if the network continues operating normally and the incident remains isolated to Binance’s systems.
Past exchange hacks, including the Bybit theft cited in the article, have often triggered immediate risk aversion, heightened withdrawals and volatility. Longer-term effects depend on the scale of losses, recovery prospects, regulatory or operational responses, and whether other platforms report similar compromises. The event could also prompt wallets and developers to improve authorization warnings and delegation safeguards. Overall, the security shock is bearish in the short term, while its lasting market impact is uncertain and does not by itself change Ethereum’s fundamentals.