EIP-7702 didn’t cause Binance hack, but may have amplified losses

EIP-7702, an Ethereum Improvement Proposal, did not cause Binance’s $6.3 billion hack, but it may have facilitated the attackers' bypass of security measures, according to security experts. Blockaid, a blockchain security firm, suggests that compromised signing systems likely enabled the hack, while EIP-7702 may have helped attackers bypass withdrawal safeguards.

The upgrade, introduced in May 2025 as part of the Pectra upgrade, allows wallets to use smart-contract features like bundled transactions and sponsored gas fees. However, security concerns emerged soon after its introduction, with Wintermute reporting malicious contracts in May 2025 that could drain compromised wallets. In September 2025, WLFI token holders reported losses linked to malicious EIP-7702 delegations.

The Binance attack, alleged to have been orchestrated via a compromised developer's computer, suggests that attackers could have drained the funds through various methods. EIP-7702, however, may have provided attackers with a convenient "sweep button" on Ethereum, making it easier to bypass security checks.