Compromised signing systems were likely what enabled Binance’s $6.3 billion hack, and Ethereum’s EIP-7702 upgrade may have helped the attackers bypass certain security checks, according to blockchain security firm Blockaid.

Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday that the attackers could have stolen the funds even without EIP-7702.

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,” Ben-Natan said, explaining that without the upgrade the attackers would have needed multiple transactions.

Largest Hack in Crypto History

Binance confirmed on Friday that it had suffered a $6.3 billion hack — the largest in crypto history — and pledged to cover all customer losses. The exchange said it later uncovered additional points of breach after initially suspecting that a laptop belonging to one of its engineers had been compromised.

EIP-7702 Drew Security Concerns Before the Binance Hack

Ethereum activated Ethereum Improvement Proposal 7702 (EIP-7702) in May 2025 as part of its Pectra upgrade. The proposal allows ordinary wallets to access smart-contract features such as bundled transactions and sponsored gas fees. It works by letting a wallet delegate control to contract code, and that delegation remains active until it is explicitly revoked — a detail that has shaped much of the security debate around the feature.

Security concerns surfaced within weeks. In May 2025, crypto trading firm Wintermute reported that most early EIP-7702 delegations pointed to malicious contracts designed to automatically drain compromised wallets.

The risks resurfaced in September 2025, when holders of World Liberty Financial (WLFI) tokens reported losses tied to malicious EIP-7702 delegations.

Ethereum community member VEER pointed to security warnings raised during discussions of EIP-7702 in 2024. VEER later said the Binance attack appeared broader than a single malicious signature, but noted that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

Compromised Signing Systems Suspected

Binance CEO Richard Teng said investigators had found no evidence that wallet private keys had leaked, a finding that directs attention toward the systems used to approve withdrawals rather than key custody itself.

According to Ben-Natan, the attackers may have used a compromised developer’s computer to gain access to Binance’s wallet-signing infrastructure.

“Eventually they got to a position where they could propose transactions to what is most likely a very secure signer that has custody of one of Binance’s hot wallets,” he said. “The takeaway is that ultimately the signer signed a transaction that they shouldn’t have.”

Hot wallets are internet-connected wallets that exchanges maintain to process customer withdrawals, making the approval workflow around them one of an exchange’s most sensitive security checkpoints.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, argued that EIP-7702 made little difference in the attack because the hackers already had the ability to authorize transactions. He said the attackers could have drained the funds through other methods, but warned that exchange engineers might overlook the need to revoke a malicious EIP-7702 delegation after regaining control of their systems.

“This is a problem with EIP 7702, it’s just very very poorly understood,” Georgiev said.

Ben-Natan cautioned that similar signing-system attacks pose a threat to other exchanges and said transaction simulation — previewing what a proposed transaction would do before it is signed — could help detect malicious requests before they receive approval.