Hoskinson Flags Binance Sweeper and EIP-7702 Risks
Cardano founder Charles Hoskinson warned of “seriously dangerous code” after sharing an analysis alleging that an attacker used Ethereum’s EIP-7702 delegation feature to target a Binance hot wallet. The analysis, published by CyberSatoshi, describes a custom sweeper that allegedly processed tokens and could call an external vault holding $823 million in USDC. These claims have not been independently confirmed.
CyberSatoshi said the alleged operation used 50 pre-signed authorizations to account for the wallet’s changing transaction nonce. It also acknowledged that the attacker would have needed the wallet’s private key or unrestricted access to Binance’s signing systems. EIP-7702 requires a valid signature to delegate account execution; its specification warns that delegated code can have unrestricted access to the account.
Hoskinson did not identify a specific protocol flaw or explain which parts of the analysis he endorsed. The report therefore raises questions about wallet security and signing controls, but does not establish how credentials were obtained or confirm the alleged attack’s full impact.
Neutral
The immediate market signal is neutral because the article reports allegations and technical analysis, not a confirmed exploit with a verified loss figure. It does not establish that EIP-7702 itself has a protocol flaw: the specification requires signed authorization and warns that delegated code can gain broad account access. The key unresolved issue is whether wallet credentials or signing permissions were compromised.
In the short term, traders may watch for a Binance response, withdrawal or reserve updates, and any confirmation of affected funds. If a major loss is verified, the news could trigger brief risk aversion, pressure on exchange-related assets, and volatility in ETH and stablecoin markets. Similar exchange-security scares have often caused sharp but potentially temporary reactions, with confidence and the confirmed scale of losses determining whether pressure persists.
Longer term, confirmed weaknesses in key management or delegated-code safeguards could increase scrutiny of exchange custody, EIP-7702 implementations, and authorization controls. That may raise security costs and weigh on sentiment, but clearer safeguards or evidence that the incident was limited to compromised signing access could contain broader market effects. Until facts are confirmed, traders should distinguish the alleged attack from a demonstrated Ethereum protocol vulnerability.