Binance Hacked for $6.4B

Introduction to EIP-7702

EIP-7702, also known as "Set Code for EOAs," is an Ethereum Improvement Proposal that allows externally owned accounts (EOAs) to borrow the code of a smart contract while keeping their address and funds. This upgrade was introduced in the Pectra upgrade, which went live on May 7, 2025. The proposal was written by Ethereum co-founder Vitalik Buterin and other developers, including Sam Wilson, Ansgar Dietrichs, and lightclient. EIP-7702 is a significant upgrade to the Ethereum protocol, as it enables EOAs to access the functionality of smart contracts without having to migrate to a new account type.

How EIP-7702 Works

EIP-7702 adds a new type of Ethereum transaction, the "set code transaction," which carries a list of authorizations signed with the private key of the account being upgraded. Once the transaction is processed, the account stores a small pointer to the smart contract, allowing it to run the contract's code with full access to its funds. The delegation lasts until the account owner signs a new authorization, either pointing to a different contract or clearing the pointer to restore a plain EOA. This upgrade is designed to provide more flexibility and functionality to EOAs, which are the standard wallets used by most Ethereum users. However, it also introduces new risks, as scammers can potentially use EIP-7702 to drain wallets.

The Binance Hack

On October 29, 2026, an attacker moved $6.4 billion out of Binance wallets on 10 blockchains, most of it within about 20 minutes. The attack was linked to TraderTraitor, a North Korean hacking group, according to blockchain analytics firms TRM Labs and Chainalysis. The attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, with 50 authorizations signed in advance. Binance has said its investigation began with a compromised engineer's laptop, and has since found "additional points of breach." The exchange has pledged to cover all user losses from the incident, using its SAFU fund and company funds.

Impact and Response

The Binance hack has had a significant impact on the cryptocurrency market, with Bitcoin dropping to around $76,000 and other cryptocurrencies also experiencing declines. The incident has also led to increased scrutiny of cryptocurrency exchanges and their security practices. Binance has implemented immediate precautionary measures, including temporarily suspending deposits and withdrawals, revoking the affected address authorization, and engaging law enforcement and blockchain intelligence partners to trace and recover funds. Other exchanges, such as CoinDCX, have also taken steps to restrict new futures positions due to the disruption of a key liquidity provider.

Why it matters

The Binance hack highlights the risks associated with EIP-7702, particularly the potential for scammers to use the upgrade to drain wallets. However, it also shows that the issue is not with the Ethereum protocol itself, but rather with the security measures of individual exchanges. As the cryptocurrency market continues to evolve, it is essential for exchanges to prioritize security and for users to be aware of the potential risks involved. The incident may also lead to increased regulation and oversight of cryptocurrency exchanges, potentially resulting in improved safeguards for users. On top of that, the hack demonstrates the importance of solid security measures, such as multi-factor authentication and regular security audits, to prevent similar incidents in the future.