EIP-7702, an Ethereum upgrade activated in May 2025, allows standard wallets to temporarily adopt smart contract capabilities. This includes features like batched transactions, gas sponsorship, and limited-permission keys. However, delegated code gains full access to the wallet's funds, posing significant security risks. In October 2026, an attacker exploited EIP-7702 to drain a Binance hot wallet, resulting in a $6.4 billion hack attributed to North Korea.
EIP-7702, titled "Set Code for EOAs," was proposed by Ethereum co-founder Vitalik Buterin and other developers. It was part of the Pectra upgrade, which went live on May 7, 2025. The upgrade introduces a new type of transaction called the "set code transaction," which allows an account to delegate its code to a smart contract. This delegation lasts until the account owner signs a new authorization.
The upgrade was designed to deliver three main features: batching, sponsorship, and privilege de-escalation. However, these features also carry risks. The specification warns that delegated code gets "unrestricted access to the account," and apps should never ask users to sign an EIP-7702 authorization. Scammers quickly exploited the upgrade, with over 80% of EIP-7702 delegations pointing to malicious "sweeper" contracts within weeks of Pectra's launch.
In the Binance hack, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled. The hack involved 50 authorizations signed in advance, allowing the attacker to sweep assets into addresses it controlled. Binance's investigation began with a compromised engineer's laptop, and the company has since found "additional points of breach." The hack highlights the security risks associated with EIP-7702 and the need for careful implementation.