EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
EIP-7702 allows ordinary Ethereum Externally Owned Accounts to execute smart-contract code without changing their address or private key. The feature, activated on 7 May 2025 during the Pectra upgrade, creates new convenience and new risks for wallet users.
Attackers trick victims into signing an EIP-7702 authorization that points the account to a malicious contract. The contract can then transfer ETH, tokens, and NFTs without requiring additional signatures from the owner. Because the delegation remains in the account state until replaced or cleared, funds can disappear long after the original signature and even after the user has left the malicious site.
The authorization message contains chain_id, the target contract address, and the account nonce. It is signed with the standard secp256k1 curve and encoded as keccak256(0x05 || rlp([chain_id, address, nonce])). Unlike an ERC-20 approve, the signature grants the contract the ability to run arbitrary code in the context of the victim address, potentially affecting all assets and future deposits.
Researchers found that more than 80 percent of observed delegations shortly after Pectra pointed to variants of automatic-drain contracts. A later 2026 study across seven networks identified 924 malicious delegated accounts linked to over $2.3 million in losses, with more than $10 million in assets still at risk. One publicized incident involved the address sven.eth, which lost roughly 9 ETH before partial recovery.
MetaMask and other wallets restrict arbitrary delegations, yet users can still be tricked through applications that support the new transaction type 0x04. Revoking a delegation requires a new authorization pointing to the zero address; simply logging out or reinstalling the wallet does not remove the on-chain pointer.
Security experts recommend checking any address on Etherscan for a “Delegated Address” field or using the cast code command against a trusted RPC endpoint. When a suspicious authorization has already been signed, users should stop depositing funds, verify the current delegation state, and revoke it only through trusted wallet software.
Related articles
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance reported on October 29, 2026, that attackers stole approximately $6.3 billion in digital assets from its hot wallets, surpassing the previous record of $1.5 billion taken from Bybit in February 2025. The FBI attributed the breach to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which has a history of high-profile operations including the 2014 Sony Pictures attack. The stolen tokens are being converted to Ethereum and laundered through decentralized finance platforms and instant exchangers. Binance covered 90 percent of losses using its SAFU fund, futures insurance reserves, and corporate treasury totaling around $6.34 billion, though this represents replacement of assets rather than recovery from the attackers. Blockchain analysis by TRM Labs linked the operation to prior campaigns against Bybit and KelpDAO through timing patterns and preparatory withdrawals via Tornado Cash. The incident contributed 2.3 percentage points to the Cassandra Index rise to 72, with the largest regional impact observed in East Asia.
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.
Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH and tokens from Binance hot wallets on Ethereum within 40 minutes, with the total including Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but instead used EIP-7702 to delegate execution code from a malicious contract to Binance 14, allowing a single sweep call to transfer all assets. Tether and Circle froze roughly $2.5 billion in USDT and USDC within the first hours, while Binance stated user funds remain secure and investigations continue. Blockchain analysis reveals 18 hours of preparation including three test runs on external wallets funded via Tornado Cash, followed by the main delegation and sweep in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a Lazarus subgroup, including gas funding patterns, test sweeps, and the use of a sweep function. ETH was moved first to an address that has not yet dispersed funds, while stablecoins were fragmented across new wallets before partial freezes took effect.
Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers
Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.