Ethereum's EIP-7702 upgrade amplified Binance breach damage but wasn't root cause
Cybersecurity specialists indicate that hackers had the capability to empty Binance's digital wallets independent of EIP-7702, though the Ethereum protocol enhancement potentially facilitated circumvention of withdrawal protection mechanisms.
Vulnerabilities in transaction signing infrastructure most likely facilitated the $6.3 billion Binance security breach, while the EIP-7702 upgrade to Ethereum potentially assisted hackers in circumventing protective measures, blockchain security company Blockaid has concluded.
The malicious actors possessed the capability to pilfer the digital assets independent of EIP-7702, according to Ido Ben-Natan, who serves as co-founder and CEO of Blockaid, in statements made to Cointelegraph on Friday.
"The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have," Ben-Natan said, noting that without this feature, hackers would have required numerous individual transactions to complete their theft.
The cryptocurrency exchange Binance acknowledged on Friday that it experienced a $6.3 billion security breach, representing the most significant theft in cryptocurrency sector history, and committed to compensating all affected parties for their losses. The trading platform revealed that its investigation uncovered multiple breach entry points beyond the initially suspected compromised portable computer owned by a member of its engineering team.
EIP-7702 faced security concerns before Binance hack
Vulnerability concerns surfaced just weeks after implementation. During May 2025, digital asset trading company Wintermute disclosed that the overwhelming majority of initial EIP-7702 delegations were directed toward malicious smart contracts engineered to automatically siphon funds from vulnerable wallets.
These vulnerability concerns reemerged during September 2025, as investors holding World Liberty Financial (WLFI) tokens documented financial losses associated with malicious EIP-7702 delegations.
An Ethereum community participant known as VEER referenced security alerts that had been raised throughout deliberations regarding EIP-7702 during 2024.
VEER subsequently stated that the assault on Binance seemed more extensive than just a single malicious authorization, though EIP-7702 provided the attackers with "a handy sweep button on Ethereum."
Signing-system compromise suspected
Richard Teng, who serves as CEO of Binance, stated that forensic investigators discovered no indication that private cryptographic keys for wallets had been exposed or leaked.
Ben-Natan suggested that the attackers potentially exploited a compromised developer workstation to establish access to Binance's transaction signing systems and infrastructure.
"Eventually they got to a position where they could propose transactions to what is most likely a very secure signer that has custody of one of Binance's hot wallets," he said. "The takeaway is that ultimately the signer signed a transaction that they shouldn't have," he said.
Ivo Georgiev, serving as co-founder and CEO of Ethereum wallet service provider Ambire, indicated that EIP-7702 had minimal impact on the attack methodology since the cybercriminals already possessed authorization capabilities for transactions.
He indicated that the perpetrators maintained the ability to extract the digital assets through alternative methodologies, though he cautioned that exchange technical personnel could potentially fail to recognize the necessity of revoking a malicious EIP-7702 delegation following the restoration of system control.
"This is a problem with EIP 7702, it's just very very poorly understood," Georgiev said.
Ben-Natan issued a warning that comparable signing-system vulnerabilities pose risks to additional cryptocurrency exchanges and suggested that transaction simulation technologies could assist in identifying malicious transaction requests prior to their authorization and approval.