Blockchain security firm Blockaid says compromised signing systems likely enabled the theft of roughly $6.3 billion from Binance, while Ethereum's EIP-7702 upgrade may have helped the attackers bypass certain security checks.

Ido Ben-Natan, Blockaid's co-founder and CEO, told Cointelegraph on Friday that the attackers could have stolen the funds even without EIP-7702.

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,” Ben-Natan said, explaining that the attackers would otherwise have needed multiple transactions.

Binance confirmed on Friday that it had suffered the $6.3 billion hack — the largest in crypto history — and pledged to cover all losses, a commitment that would keep affected users from bearing the losses. The exchange said it later uncovered additional points of breach after initially suspecting a compromised laptop belonging to one of its engineers.

EIP-7702 security concerns predate the Binance hack

Ethereum introduced Ethereum Improvement Proposal 7702 (EIP-7702) in May 2025 as part of its Pectra upgrade, allowing ordinary wallets to use smart-contract features such as bundled transactions and sponsored gas fees. Under the standard, a wallet can delegate control to smart-contract code, so a single authorization can cover multiple transfers rather than one transaction at a time — the “one sweep” capability Ben-Natan described.

Security concerns emerged within weeks. In May 2025, crypto trading firm Wintermute reported that most early EIP-7702 delegations pointed to malicious contracts designed to automatically drain compromised wallets.

The risks resurfaced in September 2025, when holders of World Liberty Financial (WLFI) tokens reported losses linked to malicious EIP-7702 delegations.

Ethereum community member VEER pointed to security warnings raised during EIP-7702 discussions in 2024. VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

Signing-system compromise suspected

Binance CEO Richard Teng said investigators had found no evidence that wallet private keys had leaked.

Ben-Natan said the attackers may have used a compromised developer's computer to gain access to Binance's wallet-signing infrastructure.

“Eventually they got to a position where they could propose transactions to what is most likely a very secure signer that has custody of one of Binance's hot wallets,” he said. “The takeaway is that ultimately the signer signed a transaction that they shouldn't have.”

Cointelegraph is publishing live updates as Binance uncovers additional breach points in the $6.3 billion hack.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions. He said the attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems. Unlike a single transaction approval, a delegation can remain in place until it is explicitly revoked — a detail that makes post-incident cleanup easy to miss.

“This is a problem with EIP 7702, it's just very, very poorly understood,” Georgiev said.

Ben-Natan warned that similar signing-system attacks threaten other exchanges and said transaction simulation could help detect malicious requests before they receive approval. Attention now centers on two threads the executives flagged: whether Binance's ongoing review uncovers further breach points, and whether exchanges and wallet providers make delegation revocation and transaction simulation standard parts of their security routines.