Ethereum has long operated on a foundational divide between two distinct types of accounts. For years, standard users have relied on Externally Owned Accounts (EOAs)—the conventional wallets controlled by a private key that are capable of little more than basic token transfers and executing simple transactions. On the other side of the ledger sit smart contract accounts, which possess the capability to run arbitrary code. These programmable accounts unlock advanced features that standard wallets historically lacked, including customizable spending limits, seamless account recovery options, and the ability to pay transaction fees in tokens other than ETH. Despite these clear advantages, the vast majority of everyday users never migrated to smart contract accounts due to the friction of moving funds, setting up new addresses, and abandoning legacy infrastructure.
To bridge this long-standing gap in the Ethereum ecosystem, developers introduced EIP-7702. Rather than forcing users to undergo the cumbersome process of migrating their assets and identities to entirely new wallet types, the proposal allows existing EOAs to temporarily borrow the code of a smart contract. This innovative mechanism lets users retain their original addresses and existing funds while instantly unlocking the powerful capabilities of programmable accounts.
What is EIP-7702?
Officially titled "Set Code for EOAs," EIP-7702 was authored in May 2024 by Ethereum co-founder Vitalik Buterin alongside core developers Sam Wilson, Ansgar Dietrichs, and lightclient, according to the official specification. The proposal emerged as one of the headline architectural changes included in Pectra, a major Ethereum network upgrade that went live on May 7, 2025.
The upgrade was widely hailed by developers as a crucial stepping stone for the network’s user experience and technical maturity. "EIP-7702 lays the foundation we’ve needed for a long time," Ethereum core developer Preston Van Loon noted shortly after the deployment. While he acknowledged that full account abstraction would not be immediately available to every end user with the launch of Pectra, he emphasized that the upgrade successfully provided Ethereum with the underlying infrastructure required to support it moving forward. Because EIP-7702 is implemented directly as a change to Ethereum’s core protocol rather than as a standalone token or a separate layer-2 blockchain, users did not need to purchase any new assets or alter their basic security mindsets regarding token holdings.
How Does EIP-7702 Work?
The mechanics of EIP-7702 revolve around the introduction of a new transaction type on the Ethereum network known as the "set code transaction." This specialized transaction carries a list of authorizations, each meticulously signed with the private key of the account being upgraded. Each authorization explicitly designates the address of a smart contract that the user wants their account to utilize.
Once the network processes this transaction, the targeted account securely stores a small pointer—referred to in the protocol as a delegation indicator—pointing directly to the specified smart contract. From that moment forward, whenever any external actor or application calls the account, the Ethereum Virtual Machine executes the referenced contract’s code as if it belonged natively to the account itself, granting the code full access to the account’s underlying funds and permissions.
This delegation remains active and operational until the account owner chooses to sign a new authorization, which can either point the account toward a different smart contract entirely or clear the pointer completely to restore the address to a plain, traditional EOA. Notably, the protocol marks these delegated accounts using the specific byte 0xef, a code value that was intentionally reserved and banned during earlier network upgrades precisely to accommodate future protocol-level changes like this one.
The Security Risks
While the architectural flexibility introduced by EIP-7702 solved a major usability bottleneck, the underlying power of the feature inevitably introduced severe security risks. Because a delegated account essentially hands over unrestricted access to foreign code, the protocol’s authors and security researchers issued immediate warnings. The specification explicitly cautions that decentralized applications should never ask everyday users to sign an EIP-7702 authorization directly through an interactive interface, and warns wallet providers against building user-facing features for it, stating bluntly that there is no safe way to provide such an interface to general retail users.
Malicious actors moved rapidly to exploit these vulnerabilities. Within weeks of the Pectra upgrade going live, blockchain trading and analytics firm Wintermute discovered that more than 80% of active EIP-7702 delegations were pointing directly to copies of the same malicious "sweeper" contract. These automated exploits were designed to instantly drain any wallet whose underlying private keys had been leaked or compromised, turning a well-intentioned protocol upgrade into a potent tool for digital theft.
EIP-7702 and the Binance Exploit
The theoretical dangers of programmable account delegation materialized on a historic scale on October 29, 2026. Within a frantic 20-minute window, an attacker managed to siphon approximately $6.4 billion out of Binance hot wallets spanning 10 different blockchains. Prominent blockchain analytics firms TRM Labs and Chainalysis swiftly attributed the multi-chain heist to TraderTraitor, the notorious North Korean hacking group that had previously been linked by the FBI to the massive $1.5 billion Bybit crypto heist in February 2025.
On the Ethereum network specifically, the perpetrator leveraged EIP-7702 delegation capabilities to transform a targeted Binance hot wallet into a custom sweeper contract controlled by the attacker. According to findings published by TRM Labs, the hackers used 50 pre-signed authorizations to execute the takeover. An operational wallet funded through the privacy-focused crypto mixer Tornado Cash submitted the signed authorizations, allowing the hot wallet to run the attacker’s custom code. Once the delegation was established, the attacker triggered the wallet to automatically sweep its substantial assets into addresses under their direct control, as detailed by Chainalysis.
Security analysts were quick to emphasize a critical nuance regarding the nature of the exploit. EIP-7702 delegations fundamentally require a valid, cryptographic signature originating from the account being upgraded. Because Binance wallets operating on the other nine non-Ethereum blockchains also transferred funds to the attacker through ordinary, pre-signed transfers, TRM Labs concluded that the breach stemmed from a fundamental compromise of Binance’s internal hot wallet signing and key management infrastructure rather than any inherent security flaw or vulnerability in the Ethereum protocol itself. Binance confirmed that its internal investigation originated from a compromised engineer’s laptop and subsequently uncovered additional points of breach within its corporate systems.
The Future of EIP-7702
Despite the severe security challenges and high-profile exploits that shadowed its early deployment, EIP-7702 remains a critical foundational step toward full account abstraction—a long-sought goal within the Ethereum development community aimed at making every user account on the network as flexible and programmable as a smart contract. The creators of the proposal intentionally designed it to be forward-compatible with this eventual endgame, ensuring that wallets and applications built on top of the framework will continue to function seamlessly as the Ethereum account model evolves over time.
The next major milestone in this ongoing architectural journey is expected to arrive with Hegotâla, an upgrade slated to follow the Glamsterdam hard fork on Ethereum’s development roadmap. In February 2026, Vitalik Buterin highlighted the progress of EIP-8141, describing it as an omnibus proposal designed to wrap up and permanently resolve every remaining problem that previous iterations of account abstraction were meant to address, noting that it appeared entirely feasible to implement within a year during the Hegotâla fork.
Reminiscing on the decade-long pursuit of the technology, Buterin noted that developers have been actively discussing account abstraction ever since early 2016, pointing back to the original EIP-86. Discussions are also actively underway regarding how legacy accounts might eventually be brought into the new framework, which would natively provide batching capabilities and sponsored transactions to all users. These initiatives form a crucial part of a much wider architectural rebuild. Describing a fresh draft of Ethereum’s long-term roadmap, Buterin characterized the ongoing efforts as the network’s most ambitious structural overhaul since the Merge successfully transitioned the blockchain to proof of stake in 2022.
Decentralized Applications (dApps)
Decentralized Applications (dApps)
Decentralized Applications (dApps)
