Electra

Tornado

Future

Ethereum

<p style="text-align: justify"><a href="https://en.coin-turk.com/vitalik-buterin-shares-new-ai-privacy-experiment-outlines-ethereums-next-phase/" rel="noopener noreferrer nofollow">Ethereum</a>’s Pectra upgrade, which went live in May 2025, introduced one of the platform’s most ambitious changes: EIP-7702. This proposal enables standard Ethereum wallets—known as externally owned accounts (EOAs)—to temporarily adopt the capabilities of smart contracts without migrating funds or addresses. The enhancement aims to make Ethereum accounts more flexible, while also raising new security concerns.</p>
<h2 id="understanding-eip-7702-and-the-pectra-upgrade">Understanding EIP-7702 and the Pectra Upgrade</h2>
<p style="text-align: justify">Ethereum is built around two account types. The majority of users rely on EOAs, controlled by private keys and limited to basic actions like sending funds. Smart contract accounts, by contrast, run on code and support advanced features such as customizable permissions, spending limits, and recovery options. EIP-7702, titled “Set Code for EOAs,” was developed by Ethereum co-founder Vitalik Buterin along with Sam Wilson, Ansgar Dietrichs, and lightclient in May 2024, and was launched as part of the Pectra hard fork.</p>
<p style="text-align: justify">The Pectra upgrade combined two previously planned updates, Prague and Electra, to deliver changes improving scalability, transaction efficiency, and account abstraction. Through Pectra and specifically EIP-7702, developers sought to make these advanced functionalities available to standard wallets by allowing them to delegate their logic to smart contracts when needed.</p>
<p style="text-align: justify">EIP-7702 introduces a new type of Ethereum transaction called “set code transaction.” This lets users authorize their wallet to temporarily delegate its behavior to a smart contract using a cryptographically signed list. The account then points to that contract, which acts on its behalf and gets full access to wallet funds until the user removes or changes the delegation.</p>
<p style="text-align: justify">Mini dictionary: Pectra Upgrade, the combined Ethereum hard fork launched in May 2025, merges the Prague and Electra proposals to introduce technical improvements, including account abstraction, more flexible gas payments, enhanced smart contracts, and staking features.</p>
<p style="text-align: justify">Preston Van Loon, a core Ethereum developer, described EIP-7702 as providing essential infrastructure for future protocol changes. He emphasized that while account abstraction is not fully live for end users, Pectra delivered the technical groundwork necessary for it.</p>
<blockquote>
 <p>EIP-7702 lays the foundation we’ve needed for a long time, with this upgrade giving Ethereum the infrastructure to support full account abstraction in the future.</p>
</blockquote>
<h2 id="opportunities-and-vulnerabilities">Opportunities and Vulnerabilities</h2>
<p style="text-align: justify">EIP-7702’s key features include transaction batching, gas fee sponsorship (where another account can pay fees on behalf of the user), and privilege de-escalation by assigning limited-use keys. However, granting smart contracts unrestricted access to wallet contents also opens up new risks.</p>
<p style="text-align: justify">The EIP-7702 specification warns wallets and apps never to directly expose the delegation process to users, stating there is no safe way to provide such an interface because delegated code can drain all funds in an account.</p>
<p style="text-align: justify">Security incidents followed swiftly after launch. In June 2025, the blockchain research firm Wintermute reported that over 80% of EIP-7702 delegations pointed to malicious contracts designed to empty wallets with compromised keys.</p>
<table style="border:1px solid #f1e4d8;padding:8px">
 <thead>
  <tr>
   <th>Feature</th>
   <th>Benefit</th>
   <th>Risk</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Batching</td>
   <td>Combine multiple actions in one transaction</td>
   <td>Potential for accidental or malicious draining</td>
  </tr>
  <tr>
   <td>Sponsorship</td>
   <td>Gas fees can be paid by third parties</td>
   <td>Third party may exploit permissions</td>
  </tr>
  <tr>
   <td>Privilege de-escalation</td>
   <td>Generate sub-keys with limited rights</td>
   <td>Poor configuration could still allow full access</td>
  </tr>
 </tbody>
</table>
<h2 id="the-6-4-billion-binance-hack-north-korean-links">The $6.4 Billion Binance Hack: North Korean Links</h2>
<p style="text-align: justify">On October 29, 2026, an unprecedented exploit occurred when an attacker used EIP-7702 to drain approximately $6.4 billion in digital assets from Binance, the world’s largest crypto exchange by trading volume. Blockchain analytics firms TRM Labs and Chainalysis publicly attributed the hack to TraderTraitor, a North Korean group previously identified in major crypto thefts, including the $1.5 billion Bybit incident in February 2025.</p>
<p style="text-align: justify">TRM Labs stated that nearly all the funds were moved off 10 blockchains, most of it in just 20 minutes, through sophisticated transfers beginning at 4:05 p.m. ET. On Ethereum, the attacker delegated a Binance hot wallet’s behavior to a custom sweeper contract using 50 pre-signed authorizations. These authorizations, submitted via an operational wallet funded through the cryptocurrency mixer Tornado Cash, gave the attacker full control to sweep assets into new addresses. On other blockchains, funds were transferred using standard signed messages.</p>
<p style="text-align: justify">Mini dictionary: TraderTraitor, a North Korean hacking group, is known for executing large-scale cyberattacks against crypto exchanges and protocols. The group has been linked to several high-profile thefts and is monitored by global law enforcement agencies.</p>
<p style="text-align: justify">According to TRM Labs, the successful use of EIP-7702 in this exploit indicated not a flaw in Ethereum itself, but a compromise in Binance’s internal hot wallet signing infrastructure. Binance traced the initial breach to a compromised engineer’s laptop, later discovering other vulnerabilities within its system.</p>
<blockquote>
 <p>TRM Labs and other analytics firms attributed the record-breaking theft to North Korea, citing a detailed analysis of blockchain activity and “robust on and off-chain intelligence.”</p>
</blockquote>
<p style="text-align: justify">The event is considered the largest crypto theft to date. It highlights both the power and dangers of advanced Ethereum features, reinforcing the need for improved wallet security and cautious integration of new protocol capabilities.</p>
<h2 id="the-roadmap-ahead-account-abstraction-and-future-upgrades">The Roadmap Ahead: Account Abstraction and Future Upgrades</h2>
<p style="text-align: justify">EIP-7702 represents a major move toward Ethereum’s ultimate goal of account abstraction—a framework where all accounts can function like smart contracts, offering flexibility without specialized infrastructure. The proposal’s authors designed it for forward compatibility, ensuring current wallets can adapt as Ethereum’s ecosystem evolves.</p>
<p style="text-align: justify">The next significant protocol upgrade could be Hegotá, the proposed successor to the Glamsterdam fork. In February 2026, Vitalik Buterin suggested that EIP-8141, a comprehensive solution for account abstraction, could launch within a year as part of Hegotá. By July 2026, Buterin described the upcoming roadmap draft as the most significant overhaul since Ethereum switched to proof of stake in 2022.</p>
<p style="text-align: justify">As Ethereum continues its ambitious upgrades, the network’s expanding capability is matched by new challenges in user and platform security.</p>
<p>The post <a href="https://en.coin-turk.com/binance-hot-wallet-exploited-for-6-4-billion-via-eip-7702-delegation-trm-labs-links-hack-to-north-korea/" rel="noopener noreferrer nofollow">Binance hot wallet exploited for $6.4 billion via EIP-7702 delegation, TRM Labs links hack to North Korea</a> appeared first on <a href="https://en.coin-turk.com" rel="noopener noreferrer nofollow">COINTURK NEWS</a>.</p>

Binance hot wallet exploited for $6.4 billion via EIP-7702 delegation, TRM Labs links hack to North Korea

Table of Contents

COINTURK NEWS

Other articles published on Oct 30, 2026

Join our free newsletter for daily crypto updates!