Brief
- EIP-7702 is an Ethereum upgrade that was enabled in May 2025, allowing standard wallets to temporarily acquire the capabilities of smart contracts.
- It supports batch transactions, fee sponsorship, and limited permission keys, but the entrusted code will gain full access to the wallet funds.
- Analysts claim that in October 2026, attackers used EIP-7702 to transfer funds from a hot wallet with the ID Binance, involving a $6.4 billion hacking incident, for which North Korea was attributed responsibility.
There are two types of accounts on Ethereum. External owned accounts ( EOA ) are the standard wallets used by most people, controlled by a private key, and they typically have limited capabilities, mainly for sending transactions. Smart contract accounts, on the other hand, can execute code and support features such as setting spending limits, account recovery, and paying transaction fees with tokens other than ETH, but most users have not migrated to this type of account.
EIP-7702 attempts to bridge this gap. It does not require users to migrate to a new wallet, but rather allows the existing EOA to leverage the coding capabilities of smart contracts while retaining their original addresses and funds.
This guide explains what EIP-7702 is, how it works, why developers are pushing for this upgrade, and how attackers took advantage of it in the largest crypto theft case in history.
What is EIP-7702?
The title of EIP-7702 is "Setting Code for EOA". According to official specifications, it is an Ethereum improvement proposal written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs, and lightclient.
It is one of the core changes of Pectra. Pectra is a major upgrade to Ethereum, which was launched on May 7, 2025.
Ethereum core developer Preston Van Loon said at that time about Decrypt: “EIP-7702 has laid the foundation for what we have needed for a long time. Although Pectra will not immediately provide end-users with complete abstraction capabilities, this upgrade provides Ethereum with the infrastructure to support this direction in the future.”
EIP-7702 is a modification to the Ethereum core protocol; it is neither a token nor an independent blockchain, therefore, there is nothing that can be purchased.
How does EIP-7702 work?
EIP-7702 A new type of Ethereum transaction has been added, namely the "Code Setting Transaction." This type of transaction includes a set of authorizations, each of which is signed with the private key of the account being upgraded, and specifies the address of the smart contract that the account wishes to use.
After the transaction is processed, the account will store a very small pointer, known as a delegation identifier, which points to that contract. From then on, whenever someone accesses that account, Ethereum will execute the code of that contract as if it belonged to that account, and will have full access to the funds.
This delegation will continue until the account owner signs a new authorization, either directing it to another contract or clearing that pointer, allowing the account to revert back to its normal state as EOA.
Do you know?
EIP-7702 uses the byte 0xef to mark the entrusted account. This code value was prohibited from use during earlier upgrades in order to reserve it for such special purposes.
What makes EIP-7702 so special?
This specification lists the three main functions it aims to achieve:
- Batch processing: Combining multiple operations into a single transaction, for example, authorizing a certain token first and then conducting an exchange.
- Sponsorship: It is allowed for another account, such as an application, to pay the transaction fees on behalf of the user, and the user can later repay these fees with other tokens.
- Permission downgrade: Creating subkeys with restricted permissions, for example, only able to spend a certain type of token, or only able to use 1% of the balance per day.
Security Risks
These features also come with risks. Since the entrusted code will gain "unrestricted access to the account," the guidelines warn that applications should never request users to sign a EIP-7702 authorization, nor should wallets provide an interface for this purpose. "There is no secure way to provide such an interface," the guidelines state.
Scammers quickly followed up. Within a few weeks of Pectra going live, trading company Wintermute discovered that over 80% of the EIP-7702 commissions were directed to a copy of a malicious “scrubber” contract. Such contracts automatically empty wallets with leaked private keys, as reported by The Block in June 2025.
EIP-7702 and Binance theft incidents
On October 29, 2026, attackers transferred approximately $6.4 billion from wallets on 10 blockchains owned by Binance. Most of this transfer was completed within about 20 minutes. Blockchain analysis firms TRM Labs and Chainalysis attributed this theft to TraderTraitor, a North Korean hacking group that had previously carried out a $1.5 billion hacking incident in February 2025.
On Ethereum, the attacker used a EIP-7702 contract to turn a Binance hot wallet into a cleaner under their control. TRM Labs stated that 50 authorization documents were signed in advance for this process. An operational wallet funded by an encryption mixer Tornado Cash submitted these signed authorizations, which allowed the hot wallet to execute code deployed by the attacker; subsequently, the attacker invoked this wallet to transfer the assets to their own controlled address, as indicated by Chainalysis.
The key point is that the EIP-7702 commission requires a valid signature provided by an upgraded account. Binance The wallets on the other nine chains also transferred funds to the attacker using regular signatures, which indicates that the problem is more likely to be an intrusion into the signature infrastructure of the Binance hot wallets, rather than a defect in Ethereum itself, as TRM suggests.
Binance indicates that the investigation initially began with a compromised engineer's laptop, and subsequently, 'more intrusion points' were discovered.
The Future of EIP-7702
EIP-7702 is the first step towards complete account abstraction. Account abstraction is a long-term goal aimed at making every Ethereum account as flexible as a smart contract. Its author designed it to be compatible with this “endgame,” so wallets built on it today should continue to be usable as the Ethereum account model evolves.
The next step may come from Hegot. This is an upgrade planned in Ethereum's roadmap to be launched after Glamsterdam. In February 2026, Buterin indicated that EIP-8141 "seems possible to be implemented within a year" and will be implemented in the Hegot fork. He referred to EIP-8141 as "an all-encompassing solution designed to integrate and address all the remaining issues that account abstraction needs to solve."
"We have been discussing account abstraction since the beginning of 2016," Buterin wrote, and added that developers are also discussing whether existing accounts can be integrated into the new framework so that they can natively benefit from batch processing and sponsored transaction features.
This is also part of a larger-scale restructure. In July 2026, Buterin described the new draft of Ethereum's long-term roadmap as the biggest transformation of the network since the shift to proof-of-stake in 2022.
Daily Briefing Newsletter
Starting with the latest headlines every day, along with original features, podcasts, videos, and more.
Join 72,000+ readers
