EIP-7702 is an Ethereum protocol upgrade activated on May 7, 2025, as part of the Pectra release. It introduces a new transaction type that allows externally owned accounts (EOAs)—standard wallets controlled by private keys—to temporarily adopt the capabilities of smart contract accounts without migrating to new wallets.
The upgrade adds a "set code transaction" that carries authorizations signed by an account owner, pointing to a smart contract address. Once processed, the account stores a delegation indicator to that contract. Ethereum then executes the contract's code with full access to the account's funds. The delegation persists until the owner signs a new authorization to point elsewhere or clear the delegation.
Three Intended Features
EIP-7702 was designed to deliver three main capabilities:
- Batching: combining multiple actions, such as approving a token and swapping it, into a single transaction
- Sponsorship: allowing another account to pay transaction fees on a user's behalf, potentially reimbursed in a different token
- Privilege de-escalation: creating sub-keys with limited permissions, such as spending only a specific token or a percentage of a balance per day
Security Risks
Because delegated code receives unrestricted access to the account, the EIP-7702 specification warns that apps should never ask users to sign authorizations and wallets should not provide interfaces for it. The specification states: "There is no safe way to provide this interface."
Exploits emerged quickly. Within weeks of Pectra's launch, trading firm Wintermute reported that more than 80 percent of EIP-7702 delegations pointed to copies of the same malicious "sweeper" contract designed to drain wallets whose private keys had been compromised.
The Binance Hack
On October 29, 2026, an attacker transferred approximately $6.4 billion from Binance wallets across 10 blockchains, with most funds moving within about 20 minutes. Blockchain analytics firms TRM Labs and Chainalysis attributed the theft to TraderTraitor, the North Korean hacking group behind the $1.5 billion Bybit hack in February 2025.
On Ethereum, the attacker used an EIP-7702 delegation to convert a Binance hot wallet into a sweeper contract, with 50 pre-signed authorizations. An operational wallet funded through crypto mixer Tornado Cash submitted the signed authorizations, allowing the hot wallet to run attacker-deployed code. The attacker then called the wallet to transfer assets to controlled addresses.
Critically, EIP-7702 delegations require valid signatures from the account being upgraded. Binance wallets on the other nine blockchains also sent funds to the attacker through standard signed transfers, indicating a compromise of Binance's hot wallet signing infrastructure rather than a flaw in Ethereum itself. Binance reported the investigation began with a compromised engineer's laptop and subsequently identified additional breach points.
Path Forward
EIP-7702 represents a step toward full account abstraction, a long-standing Ethereum goal to make every account as flexible as a smart contract. The upgrade was designed to be forward-compatible with that outcome, so wallets built on it should continue functioning as Ethereum's account model evolves.
Future developments may come through EIP-8141, proposed as a comprehensive solution to remaining account abstraction challenges. In February 2026, Ethereum co-founder Vitalik Buterin stated that EIP-8141 looked "possible to make happen within a year" in the planned Hegotá fork.
