← Back to research
On-Chain Investigations

EIP-7702 Explained: How One Signature Drained Binance's Hot Wallet

EIP-7702 lets a normal Ethereum wallet run smart contract code. Here is how it works, how it was used to drain Binance 14, and how to check your own wallet.

By Stalkchain ResearchPublished Oct 30, 2026Updated Oct 30, 20264 min read
EIP-7702BinanceHack

Quick answer

EIP-7702 is an Ethereum feature, live since the Pectra upgrade in May 2025, that lets a normal wallet (an EOA) point to smart contract code and run it as its own. The wallet owner signs a short authorization, and anyone can submit it. In the Binance hack, an authorization for the Binance 14 hot wallet pointed it at a drain contract. One call to that contract then moved about $2.53B in 63 tokens out in a single transaction.

What EIP-7702 does

Ethereum has two kinds of accounts. Externally owned accounts (EOAs) are controlled by a private key and have no code. Smart contract accounts have code but no private key.

EIP-7702 blurs that line. An EOA owner can sign an authorization that says "run the code at this contract address as if it were mine." From then on, any call to the EOA executes that contract's code, with the EOA's balances.

The authorization is a small signed message with three fields:

  • Chain ID: which chain it's valid on. A value of 0 makes it valid on every chain.
  • Contract address: the code the wallet will delegate to.
  • Nonce: the wallet's current nonce, so it can't be replayed later.

It goes on-chain inside a special transaction type (type 4). The key detail: anyone can submit it, not just the wallet owner. That's what lets relayers pay gas for users, and it's what let the Binance attacker submit Binance 14's delegation from his own wallet.

The delegation stays in place until the owner signs a new one. You can see it on-chain: a delegated wallet's code starts with 0xef0100 followed by the contract address.

Why it exists

EIP-7702 was built for good reasons: batching several actions into one transaction, letting apps pay gas for users, and adding spending limits or recovery to ordinary wallets. Wallets like MetaMask use it for "smart account" features.

The same power cuts the other way. A wallet that delegates to a malicious contract gives that contract full control of everything in it. Since 2025, drainer kits have used phished EIP-7702 authorizations to empty retail wallets.

How it was used on Binance 14

The attacker's rehearsal: Tornado Cash funding, a dry run, the drain contract tested on a dummy wallet, then Binance 14 pointed at the same contract

On-chain, the Binance hack looks like this:

  1. ~16:00 UTC, Oct 29. The attacker's setup wallet 0x7C86…5CA0 deploys a drain contract, 0x63e842B054Bd624a465454D533C33F573e9c6fAe. Its main function is sweep(address, address[]): send these tokens to this address.
  2. 16:13–16:30. He tests it on a dummy wallet he controls. See the rehearsal.
  3. 20:20. The setup wallet submits a type-4 transaction containing an EIP-7702 authorization signed by Binance 14's key. Binance 14 now runs the drain contract's code.
  4. 20:24:23. The setup wallet calls Binance 14. The drain code sends about $2.53B in 63 tokens to a fresh wallet, 0x5227…2f8c, in one transaction.

The open question is step 3. A valid authorization needs Binance 14's private key to sign it. Either the key was stolen, or the signing system was tricked into signing it, or someone inside signed it. Analysts leaned toward a manipulated signing flow: with the raw key, the attacker could have moved the funds directly without a delegation. Binance's first findings point the same way. It found no evidence of a private key leak. Instead, a compromised DevOps engineer's laptop gave the attacker access to a service container that could submit withdrawal transactions. Binance hasn't yet explained how that produced the authorization; its technical post-mortem is still to come.

Why it was so effective

  • One transaction, every token. A normal drain sends tokens one by one, giving monitors time to react. The delegate swept 63 tokens at once.
  • The attacker pays the gas. He didn't need ETH in Binance 14's name or access to Binance's own transaction tooling.
  • It looks like normal signing. To the system that produced it, an authorization is just another signature request. If the review process doesn't decode what's being authorized, it can slip through. Bybit lost $1.4B in 2025 to a similar gap between what signers saw and what they signed.

How to check your own wallet

If you use an Ethereum wallet:

  1. Look up your address on Etherscan or another explorer. If it shows contract code, or a "delegated to" label, your wallet has an active EIP-7702 delegation.
  2. Check what it points to. A delegation to your wallet provider's official smart account contract is normal if you enabled smart account features. A delegation to an unknown, unverified contract is a red flag.
  3. Revoke it by signing a new authorization that points to the zero address. Most wallets now have a button for this.
  4. Never sign an authorization you don't understand. A request to "upgrade your account" from a site you don't fully trust is the most common way drainers get them.

You can paste any address into the StalkChain wallet tracker to see its recent transfers. A sudden outflow of every token at once is what a delegation drain looks like.