# EIP-7702 delegation let the Binance attacker sweep about $2.5 billion on Ethereum, and researchers propose narrower signing rules

Cardano founder Charles Hoskinson called the sweeper code "seriously dangerous." On the same day, Ethereum researchers posted drafts for short-lived, purpose-limited authorization and for wallet simulations that third parties can check independently.

- Published: 2026-10-31T05:43:59.168Z
- Canonical: https://polylog.news/crypto/2026-10-31/eip-7702-delegation-let-the-binance-attacker-sweep-about-2-5
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance), [crypto.news](https://crypto.news/hoskinson-binance-sweeper-eip-7702-debate/), [Ethereum Research](https://ethresear.ch/t/scoped-capability-tokens-for-stva/26195), [Ethereum Research](https://ethresear.ch/t/erc-draft-independent-simulation-result-for-stva/26198), [Ethereum Research](https://ethresear.ch/t/post-quantum-signatureless-authorization-with-recursive-verification/26196), [CryptoTicker](https://cryptoticker.io/en/binance-hack-hot-wallet-drained/)

On Ethereum, the Binance attacker used [Ethereum Improvement Proposal (EIP) 7702](https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance). It shipped in a 2025 network upgrade to give ordinary wallets smart-contract features. According to CoinDesk, the attacker had obtained 50 signatures from Binance's own wallet. EIP-7702 lets a wallet sign an authorization that points its account to outside contract code. Once the authorization is set, calls to the wallet run that code with the wallet's balances. The attacker pointed a Binance hot wallet to a sweeper contract, which moves many tokens in a few transactions. CoinDesk puts the Ethereum drain at about $2.5 billion, and CryptoTicker [reports $2.8 billion](https://cryptoticker.io/en/binance-hack-hot-wallet-drained/). On the other nine chains, the attacker used ordinary signed transfers.

Charles Hoskinson, the founder of Cardano, [shared an analysis on X](https://crypto.news/hoskinson-binance-sweeper-eip-7702-debate/) that blames EIP-7702 for the speed of the drain. "Careful, there is some seriously dangerous code," he wrote. Hoskinson leads a competing network, so his criticism serves Cardano's interests as well as the debate. The technical details support a narrower explanation. Every delegation still needed a valid signature from Binance's wallet, and Binance says its keys did not leak. The attacker therefore had signing power through the compromised service. EIP-7702 made the sweep faster and broader, but it did not supply the access. Other chains were drained without any comparable feature.

Three posts on Ethereum Research the same day addressed how wallets grant authority, although none of them cites the hack. One draft proposes [scoped capability tokens](https://ethresear.ch/t/scoped-capability-tokens-for-stva/26195). These are short-lived, revocable authorizations, signed as EIP-712 typed data or compatible with ERC-1271, that allow one stated action only, such as one transfer to one address. The author says they remove the "ambient authority" that broad signatures carry. A second draft defines a [standard, content-addressed simulation result](https://ethresear.ch/t/erc-draft-independent-simulation-result-for-stva/26198). A hardware device, a second machine or an outside verifier could reproduce it from the same payload and state snapshot. Simulation would then stop depending on a trusted website. A third post sketches [post-quantum authorization without signatures](https://ethresear.ch/t/post-quantum-signatureless-authorization-with-recursive-verification/26196), using recursive proofs. It argues that the quantum transition affects how authority is established, not only how signatures are produced.

## What this means

The exposure sits with exchanges, custodians and treasury operators that let hot wallets sign delegation authorizations. Ethereum's account-abstraction roadmap also incurs a reputational cost that rival chains will use against it. Delegation is a sound tool on its own. The new fact is that one compromised signing service can now authorize code that empties every token in a wallet, where before it could only move assets one transfer at a time. Calls to restrict EIP-7702 in the protocol misread the cause. The likelier response comes from operators: within weeks, custody platforms and exchanges add policy rules that refuse delegation authorizations from hot wallets or limit them to approved contracts. Proposals like scoped capability tokens would then move toward wallet standards over months. That depends on Binance's final report confirming that signing access, not a flaw in the protocol, was the entry point. Ethereum core developers formally proposing to limit EIP-7702 in the next hard fork would prove this read wrong.

## What to watch

- Whether large custodians and exchanges publish rules blocking delegation authorizations from hot wallets. That would show the industry treats this as an operations failure rather than a protocol failure.
- Whether Ethereum core developers put EIP-7702 restrictions on the agenda of their regular calls. A protocol change would reopen a feature that wallets have built on since 2025.
- Whether hardware-wallet makers adopt the draft standard for independently checkable simulation results. Adoption would cut how much users must trust the website that shows them what they are signing.