EIP-7702, activated on Ethereum in May 2025, allows a standard wallet to temporarily take on smart contract-like behavior without changing its address or moving its funds. It supports transaction batching, gas sponsorship, and restricted keys. It also comes with a blunt tradeoff: once an account delegates execution to contract code, that code gains full access to the wallet’s assets.
The mechanism drew intense attention after the October 2026 Binance hack. According to the source material, attackers used EIP-7702 during a roughly $6.4 billion theft to drain one of Binance’s hot wallets, and analysts linked the operation to a North Korean hacking group.
What EIP-7702 is
Ethereum has two account types. Externally owned accounts, or EOAs, are the standard wallets most users rely on. They are controlled by private keys and can do little beyond sending transactions. Smart contract accounts can run code, which makes features such as spending limits, account recovery, and paying gas fees with tokens other than ETH possible, but most users have never migrated to that model.
EIP-7702 was designed to narrow that gap. In the official specification, the proposal is titled "Set Code for EOAs." It was written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs, and lightclient. It became one of the headline changes in the Pectra upgrade, which went live on May 7, 2025.
At the time, Ethereum core developer Preston Van Loon told Decrypt: "EIP-7702 lays the groundwork we have needed for the long term. While full abstraction will not immediately ship to end users in the Pectra upgrade, this upgrade gives Ethereum the underlying architecture to support where it is headed."
EIP-7702 is a protocol-level Ethereum change, not a token and not a separate blockchain. There is no EIP-7702 token to buy.
How the mechanism works
EIP-7702 adds a new Ethereum transaction type called a set code transaction. That transaction carries an authorization list. Each authorization must be signed by the private key of the account being upgraded and specifies the smart contract address the account wants to use.
Once the transaction is processed, the account stores a tiny pointer to that contract, referred to as a delegation indicator. From that point on, whenever the account is called, Ethereum executes the contract code as if the account itself contained that code. The delegated code has full control over the account’s funds.
The delegation stays in place until the account owner signs a new authorization, either pointing to a different contract or clearing the pointer so the account returns to being a normal EOA.
What it was built to enable
The specification lists three core functions.
- Batching: combining multiple actions into one transaction, such as approving a token and then swapping it immediately.
- Sponsorship: allowing another account, such as a decentralized application, to pay gas fees on a user’s behalf, with the user repaying later in another token.
- Privilege de-escalation: creating sub-keys with limited permissions, such as spending only a specific token or using no more than 1% of the total balance per day.
Those features aim to give existing wallets some of the usability associated with account abstraction without forcing users into a new account format.
Why the specification warned about security
The same design creates obvious risk. The specification explicitly says delegated code has "unrestricted access to the account," and warns that applications should never induce users to sign EIP-7702 authorizations. Wallets, it says, should not expose a direct interface for doing so. "There is no safe way to provide such an interface," the specification states.
Scammers moved quickly. The Block reported in June 2025 that market maker Wintermute found more than 80% of EIP-7702 delegations in the weeks after Pectra pointed to copies of the same malicious sweeper contract, which automatically drains wallets whose private keys have already been compromised.
How EIP-7702 figured in the Binance hack
On October 29, 2026, an attacker moved about $6.4 billion from Binance wallets across 10 blockchains, with most of the funds transferred in roughly 20 minutes. Blockchain analytics firms TRM Labs and Chainalysis both attributed the theft to TraderTraitor, the North Korean hacking group also blamed for the $1.5 billion Bybit hack in February 2025.
TRM Labs said that on Ethereum, the attacker used an EIP-7702 delegation to turn one Binance hot wallet into an asset sweeper under the attacker’s control, and that 50 authorizations had been signed in advance. Chainalysis said an operational wallet funded through the crypto mixer Tornado Cash submitted those signed authorizations, causing the hot wallet to run code deployed by the attacker. The attacker then called the wallet and swept all assets to addresses under their control.
That does not mean Ethereum itself was broken. An EIP-7702 delegation requires a valid signature from the account being upgraded. TRM said Binance wallets on the other nine chains were also used to send funds to the attacker through ordinary signed transfers, pointing instead to a compromise in Binance’s hot wallet signing infrastructure rather than a flaw in Ethereum.
Binance said its investigation initially began with a compromised laptop belonging to an engineer, and that it later identified "additional points of intrusion."
What comes next
EIP-7702 is described as a first step toward full account abstraction, the long-term goal of making every Ethereum account as flexible as a smart contract. Its designers built it to be forward-compatible with that end state, so wallets built on top of it today should continue to work as Ethereum’s account model evolves.
The next step may come with the Hegotá upgrade, a major roadmap item scheduled after Glamsterdam. In February 2026, Buterin said EIP-8141, which he described as "a comprehensive package that bundles and resolves all remaining issues account abstraction is meant to solve," could be implemented "within a year" in the Hegotá hard fork.
"We have been discussing account abstraction since early 2016," Buterin wrote, adding that developers were still debating whether existing accounts could be brought into the new framework and gain native batching and gas sponsorship.
This sits inside a broader restructuring effort. In July 2026, Buterin described a new draft of Ethereum’s long-term roadmap as the network’s biggest overhaul since The Merge, the 2022 transition to proof-of-stake.
