What Is EIP-7702? How It Emptied a Binance Hot Wallet

THE QUIET LEDGER

Issue #12 | Saturday 24 October to Friday 30 October 2026
A week in which the danger came from inside an exchange's own signing system rather than from the Fed: rates held with two votes for a hike, then a Binance hot wallet was emptied through an Ethereum feature called EIP-7702

Reporting window Saturday 24 October to Friday 30 October 2026, continuing from Issue #11's cutoff at 22:00 UTC on Friday 23 October. Data cutoff 22:00 UTC on Friday 30 October (23:00 Europe/Stockholm, CET). Prices are CoinGecko 00:00 UTC snapshots unless stated; weekly changes compare the 00:00 UTC snapshots of Friday 23 October and Friday 30 October. Friday's ETF session is pending.

What is EIP-7702, and how did it empty a Binance hot wallet? It is an Ethereum feature that lets an ordinary account hand control of itself to a smart contract with a single signature. On Thursday evening an attacker used signatures apparently produced by Binance's own signing system to do exactly that, then swept the wallet in one transaction; Binance puts the total impact of the incident at about $6.3 billion and says no private key leaked. The Federal Reserve's decision the day before, a hold with two dissents for a hike, barely moved bitcoin. The theft did, and it is the week's lesson: controls that watch withdrawals do not see a change of ownership.

1. The Macro Pulse

• Bitcoin: $77,839 at 00:00 UTC on Friday, down 4.3 percent from $81,328 a week earlier, and $76,641 at the 22:00 UTC cutoff, down 5.8 percent. Thursday's close was its lowest daily close since 17 September, and Friday's low was $76,141 on Coinbase.
• Ether: $2,249.48 at 00:00 UTC, down 5.7 percent from $2,386.48, and $2,237.25 at the cutoff.
• Fear and Greed: 30, Fear, down from 50 a week earlier, after six days between 48 and 54.
• US spot ETFs: bitcoin funds took in about $441 million net over four completed sessions, Monday to Thursday, per Farside and SoSoValue figures reported by HedgeCo and FinanceFeeds. Last Friday's session, pending in Issue #11, closed at $137.9 million out. Ether funds lost about $170 million from Monday to Wednesday and $81.4 million on Thursday.
• The Fed: the Committee held its range at 3.75 to 4 percent by 10 votes to 2; Lisa Cook and Beth Hammack wanted a quarter-point hike, and the statement says inflation "remains elevated". Futures then priced an 85.7 percent chance of a December hike, CNBC reported.
• Liquidations: $1.49 billion of leveraged positions were closed in the 24 hours to Friday morning, $1.29 billion of them bets on rising prices, per CoinGlass data cited by 24/7 Wall St.

The takeaway: fund buyers added money on all four completed sessions, including the day of the Fed decision. Bitcoin traded near $81,700 on Thursday afternoon and fell below $79,000 by 21:00 UTC, within an hour of the Binance drain, and kept falling as leveraged positions were closed.

2. This Week in Headlines

Derivatives and prediction markets move onshore

Crypto.com and OG.com opened perpetual futures to eligible US customers on Tuesday at up to 5x leverage, through a CFTC-registered broker that must keep customer margin segregated. Robinhood's third quarter results, released the same week, showed event contracts earning $173 million against $120 million from crypto, which fell 55 percent. The CFTC, meanwhile, sued Utah, the tenth state it is challenging over who may police prediction markets, and the NBA signed an information-sharing memorandum with the agency.

Who holds the money behind a token

Ripple won final OCC approval for a national trust bank that will act as collateral trustee for the reserves behind its RLUSD stablecoin. Under the GENIUS Act, required reserves sit outside an issuer's bankruptcy estate and holders are paid from them first, a promise no court has yet tested. Our 27 October issue walks through the steps.

Tokenised securities reach the plumbing

The Depository Trust Company, the main US securities depository, switched on its Tokenization Service with 20 firms signed up, including Citi and J.P. Morgan. In Europe, Aviva Investors put a tokenised share class of its Ireland-domiciled, £22 billion Sterling Liquidity Fund on the XRP Ledger. Both keep the traditional custodian; the token changes how ownership is recorded and moved, not who safeguards the asset.

Treasury companies change pace

Strategy bought no bitcoin in the week to 25 October and spent $204.9 million buying back its STRC preferred shares, its filing shows, while Strive added 6,182 BTC.

International

South Korea's presidential office is reviewing a fourth delay of its 22 percent crypto gains tax, most likely to 2029, because US trading data will not reach Seoul under the OECD's reporting framework until then, Newsis reported; until the Assembly acts, January 2027 stands. Brazil's deadline for existing crypto firms to apply for Central Bank authorisation fell on Friday.

3. The Weekly Deep Dive: what is EIP-7702?

EIP-7702 is a change to Ethereum, live since the Pectra upgrade of 7 May 2025, that lets an ordinary account (one controlled by a single private key) run a smart contract's code. The specification adds a "set code" transaction, type 4. It writes a short delegation indicator, the bytes 0xef0100 followed by a contract address, into the account. From then on, any call to the account runs that contract. The purpose is convenience: batched actions, sponsored fees and spending limits without moving to a new wallet.

How a delegation is authorised

The account's owner signs an authorization naming three things: the chain, the contract, and the account's current nonce (its running count of transactions). Anyone may carry that signature on chain, which is how sponsored fees work. It is valid only at the matching nonce, a chain ID of zero makes it valid on every chain that supports it, and it lasts until replaced; delegating to the zero address clears it.

What happened at Binance

At 20:20:59 UTC on Thursday an attacker-funded account submitted one type 4 transaction carrying 50 authorizations signed by the hot wallet Etherscan labels Binance 14. Because that wallet was paying out withdrawals in almost every block, its nonce kept moving, so the attacker had signatures for 50 consecutive counts and one matched, TRM Labs told The Hacker News. At 20:24:23 UTC a single call to the now-delegated wallet moved 63 token balances, including 1,615,409,499 USDT, plus ether that TRM puts at 167,464 ETH. Co-CEO Richard Teng said the delegation bypassed Binance's normal approval controls. Binance says it has found no evidence that a private key leaked; the open question is how its signing system came to sign.

Limits and what you can check

A delegation is broader than a token approval: it hands over everything the account holds on that chain, and the transfer controls that guard payouts never see it, because nothing moves until the sweep. It still needs the account's own signature. For readers, the practical rules:

• An "upgrade to a smart account" prompt is an EIP-7702 authorization. Accept one only inside your own wallet app, never from a website.
• A block explorer shows whether an address is delegated: its code begins 0xef0100. Binance 14's code is now empty again.
• If you find a delegation you did not set, move your funds to a new wallet rather than trying to undo it.

4. Security and Onchain Radar

Confirmed: the two Ethereum transactions above; Binance's estimate that about $6.3 billion of assets were affected and nearly $3 billion frozen; Tether's freeze of more than 1.567 billion USDT and Circle's of 800 million USDC, as reported by The Hacker News. Binance has paused withdrawals, aims to restore them by Sunday, says it has set aside $6.34 billion to cover losses from its own funds and plans a full proof of reserves by Monday, Decrypt reports. Estimates and allegations: Chainalysis puts the theft at $5.912 billion and Elliptic at $6.43 billion; TRM Labs attributes it with high confidence to North Korea's TraderTraitor group. Neither Binance nor any government has named the attacker. Binance first said it was investigating, then that an engineer's laptop may have been compromised, and on Friday that it had found "additional points of breach".

Two smaller incidents rhyme with it. Keystone will destroy 18,835 hardware wallets after an intruder took the key its devices use to prove they are genuine, Bankless reports. And the US Treasury sanctioned 10 people and one entity behind North Korea's remote IT worker schemes, a reminder that the same state also seeks access from the inside, through hired staff.

The rules:

• Binance says it will cover losses itself. Any site asking you to connect a wallet or pay a fee to "claim" compensation is a scam.
• Get exchange updates only from the exchange's own app or the address you type yourself.
• An exchange balance is a claim on the exchange. Keep there only what you actively trade.
• A device that passes an authenticity check is only as trustworthy as the key behind the check; follow the maker's own guidance.

5. From the Academy Library

Delegation is the newer cousin of account abstraction under ERC-4337, and its risks resemble those of token approvals and wallet drainers, only wider. Before Monday's report, read how proof of reserves works and what it cannot show. Our 24 October issue covered another case of keys exposed through the systems around them. New readers can start at Academy School.

Three useful, non-affiliate tools: the EIP-7702 specification; Etherscan, to inspect an address's code and transactions; and the Fed's FOMC calendar.

Dates to keep

• Sunday 1 November: Binance's target for restoring withdrawals.
• Monday 2 November: Binance's promised full proof of reserves.
• About 5 November: Zcash's NU7 upgrade at block 3,543,405, after which Sprout funds cannot be spent.
• 8 and 9 December: the next Federal Reserve meeting.

The week's two big events tested different things. The Fed's tested expectations, and markets had priced most of it. Binance's tested an assumption, that checking every withdrawal is the same as controlling the wallet, and that assumption failed.

Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.

Sources and further reading

The Binance theft and EIP-7702

• Etherscan: delegation transaction with 50 authorizations, block 26,300,753
• Etherscan: sweep transaction from Binance 14, block 26,300,770
• The Hacker News: Binance suffers security breach affecting $6.3 billion in assets
• Decrypt: Binance sets aside $6.34B to cover hack losses
• TechCrunch: Binance pauses withdrawals, 29 October 2026
• NBC News: Binance targeted in $6.3 billion crypto heist
• EIP-7702: Set Code for EOAs
• Ethereum Foundation: Pectra mainnet announcement

Security

• Bankless: Keystone breach widens as attacker grabs its device authentication key
• US Treasury: sanctions on facilitators of DPRK IT worker fraud, 28 October 2026
• Zcash Foundation: Zebra 7.0.0 and NU7 on Mainnet

Regulation, markets and institutions

• Crypto.com: regulated crypto perpetuals for the US market, 27 October 2026
• SEC: Robinhood third quarter 2026 results, exhibit 99.1
• CFTC: lawsuit against Utah, 27 October 2026
• NBA: integrity framework for prediction markets
• Ripple: final OCC approval for a national trust bank
• GovInfo: GENIUS Act, Public Law 119-27
• DTCC: Tokenization Service goes live
• Ripple: Aviva Investors Sterling Liquidity Fund tokenised share class
• SEC: Strategy Form 8-K, 26 October 2026
• SEC: Strive Form 8-K, 26 October 2026
• Newsis: Korea leans towards a fourth crypto tax delay (Korean)
• Migalhas: virtual asset providers have until 30 October to seek authorisation (Portuguese)

Markets and macro

• Federal Reserve: FOMC statement, 28 October 2026
• CNBC: Treasury yields after the Fed decision
• 24/7 Wall St: bitcoin falls to a five-week low after $1.3 billion in long liquidations
• HedgeCo: spot bitcoin ETFs take in $137.3 million on 28 October
• FinanceFeeds: bitcoin ETFs take $17 million on 29 October
• Bloomingbit: bitcoin ETF flows, 23 October (SoSoValue data)
• Coinbase Exchange: BTC-USD hourly candles, 29 and 30 October
• CoinGecko: bitcoin daily snapshots
• CoinGecko: ether daily snapshots
• Alternative.me: Fear and Greed Index history