The Ethereum Upgrade Meant to Simplify Wallets Became the Binance Hack’s Weapon

MakeCryippreferred on

• EIP-7702, introduced in Ethereum’s Pectra upgrade, lets a regular wallet temporarily delegate its behavior to a smart contract through a signed authorization, a feature built to make wallets more flexible for everyday users
• TRM Labs says the Binance attacker exploited that same mechanism, submitting 50 pre-signed authorizations in one transaction to guarantee one would land on a valid transaction count and convert a Binance hot wallet into a sweeper contract
• Within roughly three and a half minutes of the delegation taking effect, the targeted wallet’s full balance, including 1.615 billion USDT, was swept out

EIP-7702 was designed to solve a genuinely useful problem. Before it, a standard Ethereum wallet, known as an externally owned account, could only do the simple things such accounts have always done: hold assets and sign transactions. Smart contract wallets, by contrast, could support more sophisticated features like batching several actions into one transaction, recovering access through social mechanisms, or sponsoring another user’s transaction fees, but only if a user set one up from the start, often at the cost of extra complexity. EIP-7702, introduced in Ethereum’s Pectra upgrade in May 2025, let an existing standard wallet temporarily take on smart-contract-like behavior through a signed authorization, without forcing users to migrate to an entirely new type of account.

That flexibility is exactly what blockchain intelligence firm TRM Labs says an attacker turned against Binance during the October 29, 2026 theft now estimated at roughly $6.36 billion. According to TRM’s published analysis, the attacker submitted a single Ethereum transaction containing 50 separate pre-signed EIP-7702 authorizations tied to a Binance hot wallet, each one pointing to a sweeper contract that only the attacker controlled.

The reason for submitting 50 authorizations at once, rather than just one, comes down to how Ethereum wallets track transaction order. Every wallet has a steadily increasing transaction count, called a nonce, and a signed authorization is only valid for signing against a specific nonce value. By pre-signing authorizations across a range of 50 consecutive nonce values in advance, the attacker guaranteed that whichever transaction the Binance hot wallet processed next, it would land on one of those pre-signed values and activate the malicious delegation, regardless of the wallet’s exact activity in the meantime.

Once that delegation took hold, the hot wallet effectively began behaving as the attacker’s sweeper contract instructed. TRM’s timeline shows the wallet’s entire balance, including 1.615 billion USDT along with 63 other tokens, swept out within roughly three and a half minutes of the delegation taking effect, followed by further sweeps over the following hours as additional balances flowed into the compromised wallet.

The episode illustrates a recurring tension in blockchain infrastructure design: features built to make wallets more capable and more convenient for ordinary users can also expand what an attacker can do once they gain even partial access to a wallet’s signing process, since a delegation mechanism designed to let a wallet act more like a smart contract does not inherently distinguish between a legitimate owner’s intent and an attacker who has found a way to produce a valid signature. The full technical breakdown is published on TRM Labs’ own blog.