EIP-7702, titled "Set Code for EOAs," is an Ethereum protocol change written by Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient in May 2024. The upgrade launched as part of Pectra on May 7, 2025.
The proposal adds a new transaction type that lets externally owned accounts (EOAs) temporarily delegate to smart contract code without changing their address or moving funds. A user signs authorizations with their private key naming a contract address. Once processed, the account stores a delegation indicator pointing to that contract, and Ethereum runs the contract's code with full access to the account's assets. The delegation persists until the owner signs a new authorization to point elsewhere or clear it.
EIP-7702 marks delegated accounts using the byte 0xef, a code value reserved for this purpose. The specification warned that delegated code gets "unrestricted access to the account" and stated "there is no safe way to provide this interface" for users to sign authorizations.
Attackers exploited the feature within weeks. In June 2025, trading firm Wintermute found that more than 80% of EIP-7702 delegations pointed to copies of the same malicious sweeper contract that automatically drains wallets with leaked keys.
On October 29, 2026, an attacker moved $6.4 billion from Binance wallets across 10 blockchains. Blockchain analytics firms TRM Labs and Chainalysis attributed the theft to TraderTraitor, the North Korean hacking group behind the $1.5 billion Bybit hack in February 2025. On Ethereum, the attacker used an EIP-7702 delegation with 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper contract. Chainalysis said an operational wallet funded through Tornado Cash submitted the authorizations, letting the hot wallet run attacker-deployed code, which then swept assets. TRM noted that EIP-7702 delegations require valid signatures from the account owner, and Binance wallets on the other nine chains sent funds through ordinary signed transfers, pointing to a compromise of Binance's signing infrastructure rather than a flaw in Ethereum itself. Binance said its investigation began with a compromised engineer's laptop and found "additional points of breach."
EIP-7702 serves as a first step toward full account abstraction. In February 2026, Buterin said EIP-8141, which he described as "an omnibus that wraps up and solves every remaining problem" account abstraction aimed to address, looked "possible to make happen within a year" in the planned Hegotá fork. Buterin noted developers were discussing whether existing accounts could join the new framework, granting them batching and sponsored transactions natively.