Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Ethereum’s EIP-7702 upgrade was likely not the direct cause of Binance’s $6.3 billion hack, but it may have been used to streamline the attacker’s asset theft and bypass security checks, Cointelegraph reported.
In an interview with Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan said the attack could have happened without EIP-7702, but the feature may have enabled multiple transactions to be executed at once. EIP-7702 was introduced with Ethereum’s Pectra upgrade in May 2025. It allows standard wallets to use smart contract functions, supporting bundled transaction execution and sponsored gas fees.
Security concerns emerged soon after its launch. In May 2025, Wintermute said most early EIP-7702 delegation cases were tied to malicious contracts designed to automatically drain assets from compromised wallets. In September that year, holders of World Liberty Financial (WLFI) tokens also reported losses linked to malicious EIP-7702 delegations.
The main cause of the Binance attack may have been a compromise of the transaction-signing system. Binance said its initial investigation found signs an engineer’s laptop may have been hacked, and the company later discovered additional points of compromise. Ben-Natan said the attacker may have used a developer’s computer to access Binance’s wallet-signing infrastructure and propose malicious transactions to the signing system that approves hot wallet transactions.