--- title: "EIP-7702 Under Scrutiny After North Korean Exploiters Drain Binance Hot Wallet" description: "Ethereum's account delegation upgrade, activated in May 2025, enabled attackers to turn a Binance wallet into an automated sweeper during a $6.4 billion heist." url: https://basisdesk.news/news/eip-7702-ethereum-binance-hack-north-korea published: 2026-10-30T14:36:32.581Z modified: 2026-10-30T14:36:32.581Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [ETH, BTC] tags: [eip-7702, binance, ethereum, hacks, pectra, account-abstraction] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # EIP-7702 Under Scrutiny After North Korean Exploiters Drain Binance Hot Wallet Ethereum's account delegation upgrade, activated in May 2025, enabled attackers to turn a Binance wallet into an automated sweeper during a $6.4 billion heist. ## At a glance - **What happened:** North Korea-linked hackers used Ethereum's EIP-7702 delegation to turn a Binance hot wallet into a sweeper during a $6.4 billion exploit on Oct. 29, 2026. - **Why it matters:** The attack underscores structural security risks in EIP-7702, which grants delegated contract code unrestricted access to an account's balances. - **Who is affected:** Binance and custodial wallet operators managing externally owned accounts on Ethereum. - **Takes effect:** 2025-05-07 - **What's next:** No next step announced. - **Primary source:** [What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack](https://decrypt.co/resources/what-is-eip-7702-the-ethereum-upgrade-behind-the-6-4b-binance-hack) — decrypt.co ## Key points - TraderTraitor drained $6.4B from Binance across 10 chains on Oct. 29, 2026, using an EIP-7702 delegation on Ethereum. - EIP-7702 went live in the Pectra upgrade on May 7, 2025, granting delegated smart contract code full control over EOA funds. - TRM Labs found an operational wallet funded via Tornado Cash submitted 50 signed authorizations to convert a hot wallet into a sweeper. ## Editorial remark - **Context:** EIP-7702 was authored in May 2024 to bring smart contract account capabilities to EOAs without requiring address migration. - **Impact:** Exchanges and custodial platforms face heightened risk when private keys leak, as delegated code can automate immediate, full-balance drainage. - **Watch:** Ethereum core developer responses regarding potential interface or protocol mitigations for unauthorized delegation authorisations. An attacker attributed to North Korea leveraged Ethereum's EIP-7702 standard to siphon assets from Binance during a $6.4 billion multi-chain theft on Oct. 29, 2026 [1]. According to blockchain analytics firms TRM Labs and Chainalysis, the breach was orchestrated by the TraderTraitor hacking group, which previously executed the $1.5 billion Bybit hack in February 2025 [1]. The incident highlights emergent vulnerabilities tied to recent Ethereum core upgrades, as covered in [North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Heist](https://basisdesk.news/analysis/north-korea-steals-billions-from-binance) [1]. Activated on May 7, 2025, as a flagship component of Ethereum's Pectra upgrade, EIP-7702 allows standard externally owned accounts (EOAs) to temporarily execute smart contract code without migrating balances [1]. Co-authored by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs, and lightclient, the mechanism enables transaction batching, gas sponsorship, and granular key permissions via signed delegation indicators [1]. However, the proposal's specification warns that delegated contracts obtain unrestricted access to account balances once authorized [1]. ## Sweeper Delegation Exploited in Binance Breach During the Oct. 29 attack, the perpetrators utilized 50 pre-signed authorizations to delegate a Binance hot wallet to a controlled sweeper contract, according to TRM Labs [1]. An operational account funded through Tornado Cash submitted these authorizations to the network, enabling the hot wallet to automate asset transfers as part of an operation that extracted $6.4 billion across 10 blockchains in roughly 20 minutes [1]. The incident follows earlier warnings documented in June 2025 by Wintermute, which found that more than 80% of active EIP-7702 delegations pointed to malicious draining scripts within weeks of deployment [1]. Further institutional implications of compromised credentials under this framework are detailed in [Blockaid Points to Signing System Compromise in $2.5B Binance Breach](https://basisdesk.news/news/binance-hack-signing-misuse-blockaid-eip-7702) [1]. At the time of writing, $ETH traded at $2,217, down 5.6% over the preceding 24 hours, while $BTC stood at $76,619 amid broader market fear. The exploit demonstrates how attackers are pairing compromised private keys with newer account abstraction features to accelerate automated capital flight, leaving core developers and exchanges to confront architectural security trade-offs. ## FAQ **What is Ethereum's EIP-7702 proposal?** EIP-7702 is an Ethereum core upgrade that allows standard externally owned accounts to temporarily borrow smart contract code, enabling batched actions and fee sponsorships. **How did attackers use EIP-7702 against Binance?** TraderTraitor submitted pre-signed authorizations that delegated a Binance hot wallet to a sweeper contract, allowing automated draining of assets across the network. ## Sources 1. [What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack](https://decrypt.co/resources/what-is-eip-7702-the-ethereum-upgrade-behind-the-6-4b-binance-hack) — decrypt.co, 2026-10-30 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai