EIP-7702 Not Behind Binance Hack, but Could Have Worsened Losses

Blockchain security firm Blockaid believes the scale of Binance’s $6.3 billion hack may have been enabled by a compromise of the exchange’s wallet signing setup—rather than a straightforward private-key leak. In an interview with Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan also said Ethereum’s EIP-7702 upgrade could have made the theft easier by allowing attackers to execute “sweeping” transaction patterns more efficiently.

Binance has confirmed the incident and pledged to cover users’ losses. The exchange said it later found additional breach points after initially suspecting a compromised laptop belonging to one of its engineers. Against that backdrop, Blockaid’s assessment raises a broader question for the industry: if signing systems can be reached through operational compromise, upgrades that change transaction behavior may become new attack surface—unless delegations and permissions are carefully revoked and monitored.

Key takeaways

• Blockaid suggests Binance’s attackers likely compromised components of the exchange’s wallet-signing infrastructure, not necessarily by leaking private keys.
• According to Blockaid, EIP-7702 may have helped attackers bypass or reduce the need for multiple transaction steps by enabling bundled authorization flows.
• Prior EIP-7702 incidents were reported in 2025, including cases involving malicious delegations that drained wallets.
• Experts interviewed by Cointelegraph warn that EIP-7702 risks can persist if exchanges or engineers fail to revoke malicious delegations after systems are restored.

Binance hack: signing infrastructure at the center

Binance confirmed Friday that it suffered the $6.3 billion hack—described as the largest in crypto history—and stated it would compensate for all losses. In public updates, the exchange said it uncovered more breach points after its initial theory focused on a compromised laptop tied to one of its engineers.

Blockaid’s Ben-Natan told Cointelegraph that the firm’s view centers on access to Binance’s signing process. He said investigators may not find direct evidence that wallet private keys leaked, but that attackers could still win if they reached a position where they could prompt an otherwise secure signer to authorize an unauthorized transfer.

Ben-Natan’s core argument was that attackers likely used a compromised developer computer to reach Binance’s wallet-signing infrastructure. In his characterization, the key moment was when the signer—kept secure precisely to prevent illicit approvals—was induced to sign a transaction it should not have approved.

Binance CEO Richard Teng said investigators found no evidence that wallet private keys had leaked.

EIP-7702’s “sweep” effect and why it may matter

EIP-7702 was introduced by Ethereum as part of the Pectra upgrade, with Ethereum.org describing it as a mechanism enabling “ordinary wallets” to use smart-contract features such as bundled transactions and sponsored gas fees. According to Blockaid, this capability may have reduced the work required for attackers who already had leverage over transaction authorization.

Ben-Natan told Cointelegraph that attackers may still have been able to steal funds even without EIP-7702, but that the upgrade could have made the process easier. He described EIP-7702 as a way to perform actions “in one sweep,” potentially enabling attackers to bypass some checks that would otherwise require multiple transactions.

That framing is important for security teams because it shifts the threat model from “key theft” toward “transaction choreography.” If a system can be manipulated into authorizing one complex action instead of a series of smaller steps, defenders have less time to detect and intervene—especially if simulation and monitoring are not tightly integrated with approval workflows.

Malicious delegations were already a known EIP-7702 risk

Concerns around EIP-7702 did not appear only after the Binance incident. According to Cointelegraph’s earlier reporting cited in the article, trading firm Wintermute flagged in May 2025 that early EIP-7702 delegations frequently pointed to malicious contracts intended to drain compromised wallets automatically.

The same risk resurfaced later that year, when token holders of World Liberty Financial (WLFI) reported losses tied to malicious EIP-7702 delegations, as described in Cointelegraph coverage in September 2025.

Ethereum community member VEER also referenced prior security warnings discussed in 2024. While VEER later suggested the Binance attack appeared broader than a single malicious signature, he argued that EIP-7702 gave attackers “a handy sweep button on Ethereum.” The implication is that EIP-7702 can amplify the impact of operational failures—turning “permission abuse” into a fast, consolidated execution path.

What other wallet experts say: authorization already mattered

Not every expert interviewed by Cointelegraph agreed that EIP-7702 is the decisive factor. Ambire co-founder and CEO Ivo Georgiev said that, in his view, the upgrade made little difference because the attackers already had the ability to authorize transactions.

Georgiev argued that the theft could have been carried out through other mechanisms. However, he warned of a related operational gap: exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

His warning highlights a practical challenge for teams responding to incidents. Even after systems are secured, the permissions already granted—especially if they are embedded in delegation schemes—may remain active unless explicitly invalidated. That means incident response may require more than restoring access controls; it can also involve verifying that no malicious authorization pathways remain on-chain.

Ben-Natan similarly warned that signing-system attacks are not limited to Binance. He suggested that other exchanges could face similar threats and emphasized that transaction simulation could help detect malicious requests before they are approved.

Looking ahead: revocation, simulation, and signing resilience

For investors and builders, the key question going forward is whether exchange security programs adapt to the reality that authorization pathways—not only private keys—can be targeted. The immediate watch items are how quickly Binance and other platforms strengthen signing workflows, incorporate stricter simulation and monitoring, and ensure that any delegated permissions tied to incident transactions are fully identified and revoked.