ABMedia reported that Binance’s wallet No. 14 was drained in a single transaction at 04:24 Taipei time on Oct. 30, with ETH and 63 other tokens worth more than $2 billion moved out. The incident quickly raised concerns among users of wallets such as MetaMask over whether Ethereum’s EIP-7702 could expose their own funds to similar risk.
Derek Chiang, founder of account abstraction wallet developer ZeroDev, wrote on X the same day that 「7702 itself is not broken」. He said users of wallets that support 7702, including MetaMask, Uniswap and Ambire, do not need to panic, and that the key question is how the attacker obtained the authorization.
What EIP-7702 does
EIP-7702 was introduced through Ethereum’s 2025 Pectra upgrade. It allows a standard externally owned account, or EOA, controlled by a private key, to sign a special message known as a 7702 authorization. That authorization temporarily attaches smart contract code to the account, giving it functions that were previously limited to smart contract wallets.
One common use case is batching transactions. On Uniswap, for example, a token swap would normally require one approval transaction and then a second swap transaction. With 7702, those actions can be combined into a single click. Chiang said the same capability also lets an attacker move every token in a wallet within one transaction.
How 7702 was used in the Binance case
According to on-chain records cited in the report, the attacker first deployed a transfer contract at 23:59 on Oct. 29. The attacker then used a previously signed 7702 authorization to delegate Binance’s wallet No. 14 to that contract, and called the wallet to move the assets out in one step.
Chiang said that without 7702, the attacker would have needed to send a separate transaction for each token. Binance was still using the wallet for normal withdrawals at the time, so the attacker’s transactions would also have had to compete with Binance’s own transactions for nonce ordering, and many of them could have failed. In that sense, 7702 let the attacker move the largest amount of funds in the shortest time.
Security firm Blockaid said 7702 delegation remains in place even after a private key is changed. It can only be revoked by signing another authorization with the original private key. That means funds sent into the wallet later could also be drained.
In a video posted at 22:34, Binance co-CEO Richard Teng said the delegation had not gone through Binance’s normal review and control process. As a result, the exchange had to suspend withdrawals and rebuild its infrastructure.
The attacker still needed a key or a signed authorization
Chiang said an attacker can only use 7702 after doing one of two things first: obtaining the wallet’s private key or tricking Binance into signing a 7702 authorization. He said the second scenario appears less likely because it is hard to imagine Binance exposing an endpoint that could sign 7702 authorizations, or even arbitrary raw messages, though he added that it cannot be ruled out before Binance releases its official post-incident report.
Binance’s preliminary investigation said it found no evidence that the wallet private key had leaked. Blockchain analytics firm TRM Labs, however, said the attacker used 50 pre-signed 7702 authorizations on Ethereum, while Binance wallets on nine other chains moved funds through standard signed transactions. Based on that pattern, TRM Labs said Binance’s hot wallet signing infrastructure was likely compromised. The exact cause still depends on Binance’s technical report.
What regular users should take from this
Chiang’s advice differed by audience.
- Wallet developers should not allow third parties to request 7702 authorizations under any circumstances. He said that, to his knowledge, no wallet currently does this, so users do not need to worry on that front.
- Regular users should stick to well-known wallets, because 7702 gives wallet developers more ways to make mistakes than before. In his words, users should choose wallets built by teams they trust.
- Companies that operate hot wallets, including exchanges, should not expose any endpoint that can sign 7702 authorizations or raw messages, including internal endpoints.
For ordinary users, the report said the more common 7702 risk is phishing. After the Pectra upgrade went live, attackers had already used 7702 to steal more than $140,000 from MetaMask users, and WLFI investors also saw wallets emptied through 7702 phishing. In both cases, victims were tricked into signing malicious authorizations.
EIP-8141 as a possible next step
Chiang said that as a contributor to account abstraction, he feels partly responsible for incidents like this because stronger account functionality also gives attackers more power. He described 7702 as a transitional proposal and said the draft EIP-8141, known as Frame Transactions, could make wallet setups safer.
His example was that if the proposal were already live, Binance could configure all of its wallets as multisig contracts rather than standard wallets and add post-conditions to transfers. Even if the multisig were compromised, the contract itself could still enforce checks such as: 「without approval from other signers, no more than 1,000 ETH can be transferred at once」.
Based on the information disclosed so far, EIP-7702 acted as the mechanism that accelerated the transfer of funds in the Binance incident. Whether it can be abused, though, still depends on an attacker first obtaining a private key or successfully tricking a target into signing an authorization. For regular wallet users, the main risk remains signature safety and phishing rather than the existence of 7702 itself.
