EIP-7702 lets a regular Ethereum wallet sign an authorization that makes it run a contract's code, which changes what it takes to secure any hot wallet or treasury. The $6.3B Binance hack, the largest crypto theft on record, shows how that plays out: about 167,000 ETH left one hot wallet in under four minutes. Woof's CTO Pavlo Horbonos breaks down how the mechanism works and what teams that hold wallets should do about it.
What EIP-7702 actually does
Say you run a hot wallet that sends a transaction almost every block. Its key never leaves the signing system, the contracts around it are audited, and nobody has touched the code in months. Then one transaction arrives, and the wallet starts taking orders from a contract nobody on the team wrote.
That's close to what happened at Binance on October 29, when roughly $6.3B left its hot wallets across multiple chains. The tool behind the biggest Ethereum drain was EIP-7702, and anyone who holds funds on Ethereum should understand it.
Shipped with the Pectra upgrade in May 2025, EIP-7702 adds a new transaction type (type 4) that carries a list of authorizations. Until then, an externally owned account, the kind controlled by a private key, could only send transactions. Now it can sign an authorization that points the account at a contract, and from that moment calls to the wallet run the contract's code with the wallet's own balance and permissions. It's useful for batching and gas sponsorship, which is why it exists. It also applies to any account a private key controls: a treasury, a protocol's admin or deployer wallet, a DAO signer, an exchange hot wallet.
Three details matter for security:
The authorization contains no amount and no recipient. It names code, so signing one hands over control rather than approving a payment.
Anyone can submit a signed authorization on-chain and pay the gas.
It applies only if its nonce matches the account's current nonce.
Case study: the Binance hack on October 29
That evening, one transaction landed on one of Binance's busiest Ethereum hot wallets. It carried 50 signed authorizations, each saying the same thing: from now on, run this contract's code. Only one had to match the wallet's current nonce, and one did.
Three and a half minutes later the wallet had sent about 167,000 ETH and more than 60 other tokens to the attacker, then told a USDC contract to release another $823M. Within the hour the attackers had sold about $325M of USDT for ETH.
Then the brakes came on. Tether froze funds 37 minutes after the main drain and Circle followed three minutes later, but the delegation itself stayed live for almost four hours.
What the case shows
No contract exploit appears anywhere in that story.
Binance says it found no evidence of a private key leak. Independent analysts recovered the signer of all 50 authorizations as the hot wallet's own key, so the chain treated them as valid, and co-CEO Richard Teng has said the delegation bypassed the usual approval process.
The contracts were never the weak point, so no audit of them would have helped. The same gap exists in any setup where something other than a person can ask for a signature.
What to do about it
Alert on delegation. Watch your wallets for any type-4 transaction or code starting with
0xef0100.Make the signer say no. Never sign an EIP-7702 authorization you didn’t plan.
Keep hot wallets small. Sweep to cold storage.
Rehearse the revocation. Know who can revoke a delegation, and how fast.
And don't plan around a freeze. Tether and Circle locked about $2.5B of stablecoins in this incident, but ETH and BTC have no issuer to call, and Bitquery found about $3.1B still sitting with the attacker two days later.
Book a call with Pasha Bergman
Schedule a call with our CEO to receive practical recommendations and a prompt proposal for upgrading your solution.
