EIP-7702 delegation let the Binance attacker sweep about $2.5 billion on Ethereum, and researchers propose narrower signing rules

On Ethereum, the Binance attacker used Ethereum Improvement Proposal (EIP) 7702. It shipped in a 2025 network upgrade to give ordinary wallets smart-contract features. According to CoinDesk, the attacker had obtained 50 signatures from Binance's own wallet. EIP-7702 lets a wallet sign an authorization that points its account to outside contract code. Once the authorization is set, calls to the wallet run that code with the wallet's balances. The attacker pointed a Binance hot wallet to a sweeper contract, which moves many tokens in a few transactions. CoinDesk puts the Ethereum drain at about $2.5 billion, and CryptoTicker reports $2.8 billion. On the other nine chains, the attacker used ordinary signed transfers.

Charles Hoskinson, the founder of Cardano, shared an analysis on X that blames EIP-7702 for the speed of the drain. "Careful, there is some seriously dangerous code," he wrote. Hoskinson leads a competing network, so his criticism serves Cardano's interests as well as the debate. The technical details support a narrower explanation. Every delegation still needed a valid signature from Binance's wallet, and Binance says its keys did not leak. The attacker therefore had signing power through the compromised service. EIP-7702 made the sweep faster and broader, but it did not supply the access. Other chains were drained without any comparable feature.

Three posts on Ethereum Research the same day addressed how wallets grant authority, although none of them cites the hack. One draft proposes scoped capability tokens. These are short-lived, revocable authorizations, signed as EIP-712 typed data or compatible with ERC-1271, that allow one stated action only, such as one transfer to one address. The author says they remove the "ambient authority" that broad signatures carry. A second draft defines a standard, content-addressed simulation result. A hardware device, a second machine or an outside verifier could reproduce it from the same payload and state snapshot. Simulation would then stop depending on a trusted website. A third post sketches post-quantum authorization without signatures, using recursive proofs. It argues that the quantum transition affects how authority is established, not only how signatures are produced.