EIP-7702, proposed in May 2024 and activated in the Pectra upgrade on May 7, 2025, allows standard Ethereum wallets to temporarily execute smart contract code while retaining their address and funds. The protocol change enables transaction batching, fee sponsorship and limited-permission keys, but it also gives delegated code full access to the wallet’s funds. According to TRM Labs, the October 29, 2026 attack on Binance used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a sweeping tool controlled by the attacker. The $6.4 billion theft, carried out across 10 blockchains, was attributed by TRM Labs and Chainalysis to the North Korean group TraderTraitor. Binance said its investigation began with a compromised engineer’s laptop and later uncovered additional breach points.
Source: Read the original article
