EIP-7702 is an Ethereum upgrade activated in May 2025 that allows standard wallets to temporarily take on the capabilities of smart contracts.

The change enables batched transactions, sponsored gas fees and keys with limited permissions. However, delegated code has unrestricted access to a wallet's funds. An attacker used an EIP-7702 delegation in October 2026 to drain a Binance hot wallet during a $6.4 billion hack that blockchain analysts attributed to North Korea.

Ethereum accounts generally fall into two categories. Externally owned accounts (EOAs), the standard wallets used by most people, are controlled by private keys and can do little more than send transactions. Smart contract accounts can execute code, enabling features such as spending limits, account recovery and fee payments in tokens other than ETH. Most users, however, have not migrated to smart contract accounts.

EIP-7702 is designed to bridge that gap without requiring users to move to new wallets. It allows existing EOAs to temporarily borrow the code of a smart contract while retaining their existing addresses and funds.

What is EIP-7702?

EIP-7702, titled “Set Code for EOAs,” is an Ethereum Improvement Proposal written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient, according to the official specification.

It was one of the main changes included in Pectra, a major Ethereum upgrade that went live on May 7, 2025.

“EIP-7702 lays the foundation we've needed for a long time,” Ethereum core developer Preston Van Loon told Decrypt at the time. “While full abstraction won't be immediately available to end users with Pectra, this upgrade gives Ethereum the infrastructure to support it moving forward.”

EIP-7702 is a change to Ethereum's core protocol, not a token or a separate blockchain. There is therefore no EIP-7702 asset to buy.

How does EIP-7702 work?

EIP-7702 introduces a new type of Ethereum transaction called a “set code transaction.” The transaction contains a list of authorizations, each signed with the private key of the account being upgraded. Each authorization identifies the address of a smart contract that the account wants to use.

After the transaction is processed, the account stores a small pointer known as a delegation indicator that refers to the smart contract. From that point, whenever the account is called, Ethereum executes the contract's code as though it belonged to the account. That code has full access to the account's funds.

The delegation remains in place until the account owner signs another authorization. The new authorization can point to a different contract or clear the pointer, restoring the account to a standard EOA.

EIP-7702 identifies delegated accounts with the byte 0xef. Earlier upgrades had banned this code value so it could be reserved for special purposes such as this.

What does EIP-7702 enable?

The specification identifies three principal capabilities:

• Batching: Several actions can be combined into one transaction. For example, a user could approve a token and then swap it without submitting separate transactions.
• Sponsorship: Another account, such as an application, can pay transaction fees on a user's behalf. The user may reimburse the sponsor in a token other than ETH.
• Privilege de-escalation: Users can create sub-keys with restricted permissions, such as authorization to spend only a particular token or no more than 1% of a balance per day.

Security risks

The same capabilities also create security risks. Because delegated code has “unrestricted access to the account,” the specification warns that applications should never ask users to sign an EIP-7702 authorization. It also says wallets should not provide an interface for signing one: “There is no safe way to provide this interface.” The distinction is important: EIP-7702 does not by itself give an application access to an EOA; access depends on a valid authorization signed by the account's private key.

Scammers began exploiting the mechanism soon after Pectra launched. Within weeks of the upgrade, trading firm Wintermute found that more than 80% of EIP-7702 delegations pointed to copies of the same malicious “sweeper” contract, which automatically drains wallets whose keys have been leaked, The Block reported in June 2025.

EIP-7702 and the Binance hack

On October 29, 2026, an attacker moved approximately $6.4 billion from Binance wallets across 10 blockchains, with most of the funds transferred within about 20 minutes. Blockchain analytics firms TRM Labs and Chainalysis both attributed the theft to TraderTraitor, the North Korean hacking group behind the $1.5 billion Bybit hack in February 2025.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper under the attacker's control. According to TRM Labs, 50 authorizations had been signed in advance.

An operational wallet funded through the crypto mixer Tornado Cash submitted the signed authorizations. This allowed the Binance hot wallet to execute code deployed by the attacker. The attacker then called the wallet and swept its assets into addresses under the attacker's control, Chainalysis said.

EIP-7702 delegations require a valid signature from the account being upgraded. Binance wallets on the other nine chains also sent funds to the attacker through ordinary signed transfers. TRM Labs said that pattern points to a compromise of Binance's hot-wallet signing infrastructure rather than a flaw in Ethereum itself.

Binance has said its investigation began with a compromised engineer's laptop and that it later found “additional points of breach.”

The future of EIP-7702

EIP-7702 is an initial step toward full account abstraction, a long-standing effort to make every Ethereum account as flexible as a smart contract. Its authors designed the proposal to be forward-compatible with that “endgame,” meaning wallets built on EIP-7702 should continue to work as Ethereum's account model evolves.

The next step could come with Hegotá, the upgrade planned to follow Glamsterdam on Ethereum's roadmap. In February 2026, Buterin said that EIP-8141, which he described as “an omnibus that wraps up and solves every remaining problem” account abstraction was intended to address, looked “possible to make happen within a year” in the Hegotá fork.

Buterin made the comments in a post on X on February 28, 2026:

Now, account abstraction. We have been talking about account abstraction ever since early 2016, see the original EIP-86: Now, we finally have EIP-8141 ( ), an omnibus that wraps up and solves every remaining problem that AA was… — vitalik.eth (@VitalikButerin) February 28, 2026

https://twitter.com/VitalikButerin/status/2027774090627715377

“We have been talking about account abstraction ever since early 2016,” Buterin wrote. He added that developers were also discussing whether existing accounts could join the new framework, which would give them native batching and sponsored transactions.

The proposal is part of a broader reconstruction of Ethereum's long-term roadmap. In July 2026, Buterin described a new roadmap draft as the network's biggest overhaul since the Merge, Ethereum's switch to proof of stake in 2022.