Blockchain security firm Blockaid has clarified that the recent $6.3 billion hack at Binance was primarily enabled by compromised signing systems rather than the Ethereum Improvement Proposal 7702 (EIP-7702). However, experts suggest the upgrade may have facilitated the attack by helping perpetrators bypass specific security checks and execute the theft in a single sweep. Ido Ben-Natan, co-founder and CEO of Blockaid, explained to Cointelegraph that while attackers could have drained the funds without EIP-7702, the protocol allowed them to avoid the need for multiple transactions.
Binance confirmed on Friday that it suffered the largest hack in cryptocurrency history, pledging to cover all losses. The exchange initially suspected a compromised laptop belonging to an engineer but later uncovered additional points of breach. Binance CEO Richard Teng stated that investigators found no evidence of leaked wallet private keys. Ben-Natan theorized that attackers likely used a compromised developer's computer to access the wallet-signing infrastructure, eventually positioning themselves to propose transactions to a secure signer holding custody of one of Binance's hot wallets.
EIP-7702 was introduced in May 2025 as part of the Pectra upgrade, enabling ordinary wallets to utilize smart-contract features like bundled transactions and sponsored gas fees. Security concerns regarding the proposal emerged shortly after its introduction. In May 2025, trading firm Wintermute reported that most early EIP-7702 delegations pointed to malicious contracts designed to automatically drain compromised wallets. These risks resurfaced in September 2025 when World Liberty Financial (WLFI) token holders reported losses linked to similar malicious delegations.
Community member VEER noted that security warnings regarding EIP-7702 had been raised during discussions in 2024. While VEER suggested the Binance attack appeared broader than a single malicious signature, they described EIP-7702 as providing attackers with a "handy sweep button on Ethereum." Ivo Georgiev, co-founder and CEO of wallet provider Ambire, argued that EIP-7702 made little difference to the outcome since hackers already possessed the ability to authorize transactions. However, Georgiev warned that exchange engineers might overlook the necessity of revoking malicious EIP-7702 delegations after regaining control of their systems, citing a poor understanding of the protocol's implications.
Ben-Natan cautioned that similar attacks targeting signing systems pose a threat to other exchanges. He suggested that implementing transaction simulation could help detect malicious requests before they receive approval. The incident highlights the complex interplay between infrastructure vulnerabilities and new protocol features in the cryptocurrency ecosystem.
Sources: Cointelegraph.