Binance hack: what is Ethereum EIP-7702, which would have amplified losses?

Home » Crypto news » Blockchain news » Binance hack: what is Ethereum's EIP-7702, which would have amplified losses?

To empty one of Binance's wallets during the record hack that occurred on Thursday, the hackers hijacked an Ethereum feature introduced in May 2025: EIP-7702. Designed to simplify the use of crypto wallets, it allowed the attacker to run a program capable of automatically transferring funds.

🔍 Discover our top 10 best cryptocurrency exchange platforms

According to TRM Labs, around $6.36 billion was stolen from 10 blockchains, mostly in around 20 minutes.

Binance, however, claims to have already frozen nearly $3 billion with the help of its partners, thus limiting the funds that can be used by hackers.

TRM Labs attributes the attack to TraderTraitor, a North Korean hacker group also responsible for the Bybit hack in February 2025.

On Ethereum, the hacker used EIP-7702 to transform a Binance hot wallet, called “Binance 14,” into a sweeper, a program designed to automatically empty a wallet.

The attacker had 50 authorizations previously signed by this wallet. He submitted them to the network from an address funded via Tornado Cash, a service allowing the origin of cryptocurrencies to be obscured.

Only one authorization was accepted, allowing the hacker to take control of the wallet. Less than four minutes later, he withdrew 167,464 ETH and 63 other tokens, representing approximately $2.5 billion.

Proposed in May 2024 by Vitalik Buterin and three other developers, EIP-7702 was deployed on May 7, 2025 with the Pectra update. It allows a classic wallet to use the code of a smart contract, without changing address or moving its funds.

👉 On the same subject – Binance hack: a theft equivalent to 19% of North Korean GDP

Its owner signs an authorization designating the contract to be used. The wallet can then automatically execute several operations, delegate the payment of fees or limit the rights granted to certain applications.

But this delegation carries a risk. Indeed, if the authorized contract is malicious, it can give an attacker control of funds, including those received later. The authorization remains active until revoked or replaced.

A few weeks after the deployment of Pectra, Wintermute had already noted that more than 80% of the EIP-7702 delegations observed pointed to variants of the same sweeper malware.

Machine-translated from French