Binance $6.3B Hack: EIP-7702 May Have Amplified the Losses

Binance has confirmed a $6.3 billion security breach, described as the largest hack in crypto history, and pledged to cover affected users’ losses. The exchange initially suspected that an engineer’s laptop had been compromised before identifying additional breach points. Binance CEO Richard Teng said investigators found no evidence that wallet private keys had leaked, directing attention toward weaknesses in the exchange’s transaction-signing and operational security systems.

Blockaid co-founder and CEO Ido Ben-Natan said attackers may have used a compromised developer computer to access Binance’s wallet-signing infrastructure. According to him, the hackers gained the ability to propose transactions to a secure signer holding one of Binance’s hot wallets, which ultimately signed an unauthorized transaction. EIP-7702 was not the root cause of the breach, but the Ethereum upgrade may have enabled attackers to execute the theft in a single sweep and potentially bypass withdrawal checks that otherwise would have required multiple transactions.

EIP-7702 was introduced in May 2025 as part of Ethereum’s Pectra upgrade, allowing ordinary wallets to use smart-account features such as bundled transactions and sponsored gas fees. Security risks surfaced soon afterward: trading firm Wintermute reported that many early EIP-7702 delegations targeted malicious contracts designed to drain compromised wallets. World Liberty Financial token holders later reported losses linked to similar malicious delegations.

Ethereum community member VEER described EIP-7702 as a “handy sweep button on Ethereum,” while Ambire co-founder and CEO Ivo Georgiev said the upgrade made little difference because the attackers already had authority to authorize transactions. The incident highlights that compromised signing systems—not EIP-7702 alone—were the central security failure, although the upgrade may have increased the speed and scale of the resulting losses.