EIP-7702 Under Scrutiny After North Korean Exploiters Drain Binance Hot Wallet

An attacker attributed to North Korea leveraged Ethereum's EIP-7702 standard to siphon assets from Binance during a $6.4 billion multi-chain theft on Oct. 29, 2026 ¹. According to blockchain analytics firms TRM Labs and Chainalysis, the breach was orchestrated by the TraderTraitor hacking group, which previously executed the $1.5 billion Bybit hack in February 2025 ¹. The incident highlights emergent vulnerabilities tied to recent Ethereum core upgrades, as covered in North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Heist ¹.

Activated on May 7, 2025, as a flagship component of Ethereum's Pectra upgrade, EIP-7702 allows standard externally owned accounts (EOAs) to temporarily execute smart contract code without migrating balances ¹. Co-authored by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs, and lightclient, the mechanism enables transaction batching, gas sponsorship, and granular key permissions via signed delegation indicators ¹. However, the proposal's specification warns that delegated contracts obtain unrestricted access to account balances once authorized ¹.

Sweeper Delegation Exploited in Binance Breach

During the Oct. 29 attack, the perpetrators utilized 50 pre-signed authorizations to delegate a Binance hot wallet to a controlled sweeper contract, according to TRM Labs ¹. An operational account funded through Tornado Cash submitted these authorizations to the network, enabling the hot wallet to automate asset transfers as part of an operation that extracted $6.4 billion across 10 blockchains in roughly 20 minutes ¹. The incident follows earlier warnings documented in June 2025 by Wintermute, which found that more than 80% of active EIP-7702 delegations pointed to malicious draining scripts within weeks of deployment ¹. Further institutional implications of compromised credentials under this framework are detailed in Blockaid Points to Signing System Compromise in $2.5B Binance Breach ¹.

At the time of writing, $ETH traded at $2,217, down 5.6% over the preceding 24 hours, while $BTC stood at $76,619 amid broader market fear. The exploit demonstrates how attackers are pairing compromised private keys with newer account abstraction features to accelerate automated capital flight, leaving core developers and exchanges to confront architectural security trade-offs.