EIP-7702 did not cause Binance to suffer a hacker attack, but it may have magnified the losses.
Security experts stated that even without EIP-7702, attackers could still transfer funds from the wallet with Binance. However, this Ethereum upgrade may have helped them bypass the withdrawal protection measures.
Blockchain security company Blockaid indicates that the compromised signature system likely contributed to the $6.3 billion hacker attack Binance, and an upgrade to Ethereum's EIP-7702 may have helped attackers bypass security checks.
Blockaid, Co-Founder and CEO, Ido Ben - Natan stated on Friday that even without EIP-7702, attackers could still steal these funds.
Ben-Natan said, "The 7702 upgrade is a way to complete this task in one go, and it could also be a way to bypass some checks they might have put in place." He explained that otherwise, the attacker would have needed to initiate multiple transactions.
On Friday, it was confirmed that the company suffered a hacker attack worth $6.3 billion, which is the largest hacker incident in the history of cryptocurrencies. The exchange pledged to bear all the losses. The exchange stated that after initially suspecting that a engineer's laptop had been compromised, more intrusion points were later discovered.
Binance Before being attacked by hackers, EIP-7702 was already facing security concerns.
In May 2025, during the upgrade at Pectra, Ethereum introduced Ethereum Improvement Proposal 7702 (EIP-7702), which allowed regular wallets to use smart contract functions such as batch transactions and having others pay Gas fees on their behalf.
Security concerns arose within a few weeks. In May 2025, the cryptocurrency trading company Wintermute reported that most of the early EIP-7702 authorizations were directed to malicious contracts, which were designed to automatically transfer assets from compromised wallets.
In September 2025, World Liberty Financial ( WLFI ) token holders reported that their losses were related to malicious EIP-7702 authorization, and these risks have resurfaced once again.
Ethereum community member VEER cited security warnings raised during discussions around EIP-7702 in 2024.
VEER later said that the attack on Binance seemed to be more widespread than a single malicious signature, but EIP-7702 indeed gave attackers a "one-click cleanup button" on Ethereum.
Suspected intrusion into the signature system
Binance The Chief Executive Officer Richard Teng stated that investigators did not find any evidence of wallet private key leakage.
Ben-Natan says that attackers may have exploited an intrusion into a developer's computer to gain access to the signature infrastructure of the Binance wallet.
He said, "In the end, they reached a point where they were able to make a transaction proposal to a signer that was likely very secure, and this signer was in charge of a hot wallet containing Binance." He also said, "The conclusion is that it was ultimately the signer who executed a transaction that it should not have signed."
Real-time update: Binance discovers more entry points in a $6.3 billion hacker attack
The co-founder and CEO of Ethereum wallet provider Ambire, Ivo Georgiev, stated that EIP-7702 was hardly affected by this attack, as the hackers already had the capability to perform authorized transactions.
He said that attackers could have transferred the funds in other ways, but he also warned that after the exchange engineers regained control of the system, they might overlook the necessity of revoking the malicious EIP-7702 authorization.
Georgiev said, "The problem with EIP 7702 is that it is not understood at all."
Ben-Natan warns that similar signature system attacks could also threaten other exchanges, and indicates that trade simulation can help identify such attacks before malicious requests are approved.
Magazine: THORChain Under Attack Due to Bitget; ETH Evolves Beyond Blockchain: Hodler's Digest
