- The Binance theft started with compromised hot wallet signing infrastructure, according to The Block, rather than with any flaw in Ethereum itself.
- EIP-7702 is a feature added to Ethereum in 2025 that lets an ordinary wallet address run code. Researchers cited by Cointelegraph say it may have helped the attackers get around withdrawal safeguards.
- We could not find a primary technical write-up of that claim, so the EIP-7702 part of the story currently rests on secondary coverage.
There is a second story running underneath the Binance headlines, and it is about Ethereum. The suggestion is that a 2025 upgrade called EIP-7702 helped attackers empty wallets faster than anyone could stop them. The upgrade is real and it does roughly what people say it does. What it did here is less settled.
EIP-7702 is live on every Ethereum address in existence, including yours. One signature can point your address at code written by someone else, and that pointer stays in place until you remove it. Knowing what that signature looks like, and how to check whether you have already given one, is the difference between using a convenience and handing over an account.
Start with what an Ethereum account is
Ethereum has always had two kinds of account, and for a decade they were separate species.
The first is the one almost everybody uses. It is controlled by a , a very long secret number held by your wallet software or your hardware device. The account has a balance and a transaction history and nothing else. It cannot do anything on its own. It only moves when a transaction signed by that key tells it to.
The second is a smart contract: an account that holds code. Code can do clever things, like refusing a payment above a certain size, or requiring three people to approve a transfer. But a contract has no key of its own and cannot start anything. It sits there until somebody calls it.
So ordinary users got the key and no code, and the useful features lived at an address that was not theirs. Moving to a smart contract wallet meant creating a new address and shifting everything across, which most people never bothered to do.
What EIP-7702 changed
EIP-7702 arrived with Ethereum’s Pectra upgrade in May 2025. It allows the holder of a normal account to sign an authorisation that writes a small pointer into that account, saying in effect: when I am called, run the code at this contract address.
The account keeps its address, its balance and its history. The private key still controls it. What changes is that the address can now behave like a programmable wallet without becoming a different wallet. The pointer is not a one-off either. It stays until the owner replaces it or clears it.
Three things people had wanted for years suddenly became possible on existing addresses. Batching, where approving a and swapping it happen in a single transaction with one confirmation and one fee instead of two of each. Sponsored transactions, where an application pays the network fee so a newcomer does not need to acquire ETH before doing anything. And rules written into the account itself, such as spending limits or a recovery contact.
The risk sits in the same design
Everything that makes delegation convenient also makes it dangerous, because the authorisation is a single signature and it grants a lot.
If that signature points at a contract written by a thief, the contract inherits the ability to move whatever the account holds. Not one token, and not one transaction. It can sweep the lot in a single batched operation, and because the pointer persists, anything arriving at the address later can be taken too. Security firms began reporting bulk delegations to sweeper contracts within months of the feature going live, usually collected through the same fake and fake support pages that have always harvested signatures.
None of that is a vulnerability in Ethereum in the sense of a bug. The system is doing exactly what it was asked to do by somebody holding the key. That distinction matters for what follows.
Four claims the coverage runs together
The first is what has actually been reported about the breach. Binance‘s hot wallet signing infrastructure was compromised, according to The Block, which put the total at around $6.3bn and called it the largest crypto theft on record. CoinDesk counted 18,270 bitcoin in the haul, worth roughly $1.4bn, more than Tesla holds and over twice El Salvador’s reserve. Tether and Circle moved to freeze while the attackers converted into assets no issuer can immobilise.
The second is attribution. investigators have linked the attack to North Korea. That is a conclusion drawn from patterns and prior cases by firms that do this professionally, not a charge or a court finding, and it is worth filing accordingly.
The third is what EIP-7702 is capable of in general, which is the batching and sponsorship described above, and which nobody disputes.
The fourth is what it did in this specific theft, and that is the thinnest part. Cointelegraph reports security experts saying the attackers could have drained the wallets without EIP-7702, but that the upgrade may have helped them bypass withdrawal safeguards. The logic is plausible: a safeguard that counts withdrawals one at a time is looking at the wrong unit when a single transaction can carry dozens of transfers. We could not locate the underlying research, Binance has not addressed the point in anything we have seen, and the experts are paraphrased rather than quoted in the coverage available to us.
The misunderstanding worth correcting
A fair number of posts have turned all of this into “Ethereum was hacked” or “EIP-7702 is a backdoor”. Neither survives contact with how the feature works.
Delegation cannot be set without a signature from the account’s own key. If an attacker already controls the signing infrastructure, as investigators believe happened here, they can sign anything at all, delegation included. The feature changes the speed and shape of the theft rather than the fact of it. The thing that was broken was key control, which is the thing that is always broken in these cases.
How to check your own address
This takes about a minute. Paste your address into a block explorer such as Etherscan and look at the address page. A normal account shows no code. A delegated one is flagged, usually with a note that the account points to a contract, and the explorer will name that contract.
If you have never signed a delegation, you do not have one, because it cannot be added without you. If you find one you do not recognise, it can be cleared by signing a new authorisation pointing the account at the zero address, which removes the code entirely. Wallets that support EIP-7702 are increasingly exposing this directly, and that is the safer route, since third-party revocation tools ask you for another signature to fix a problem that a signature caused. Moving the balance to a fresh address first is the belt-and-braces version. Our guide to self-custody covers the wider habits, and the running coverage of the breach itself is in our news archive.
What to watch
Whether Binance or the investigating firms publish a technical post-mortem that addresses EIP-7702 directly. Until one appears, the amplification claim is an informed reading of the transaction data rather than an established fact.
Beyond that, whether exchanges start rebuilding withdrawal controls that assume one transaction means one transfer. That assumption held for a decade and no longer does, and the fix is unglamorous enough that nobody will announce it.