Cardano founder Charles Hoskinson warned on Friday, October 30, about security risks tied to EIP-7702 on Ethereum. His public warning followed a technical report that described how attackers used the standard to drain assets from a Binance hot wallet on Thursday, October 29. Hoskinson posted on X and cited a bytecode reconstruction by analyst CyberSatoshi. He said seriously dangerous code was circulating, though he did not spell out which parts of the report he endorsed or point to a direct flaw in Ethereum itself.
What the Binance wallet report claims
The reconstruction claims the attacker deployed an automated sweeper contract aimed at the exchange’s setup. The malicious code kept exactly 1 ETH in the wallet during the draining process, according to the report. The apparent goal was to stop Binance’s automated monitoring from flagging failures caused by insufficient balance for gas fees. The contract also ran a loop of low-level calls to check token balances in the Binance 14 address. That design let the sequence keep working through other assets even if one contract failed or was blacklisted. A custom execution function interacted with an external vault holding $823 million in USDC. The report says that contract treated Binance 14 as a legitimate administrator, which allowed directives over funds outside its immediate on-chain balance.
How EIP-7702 delegation works
EIP-7702 lets an externally owned account temporarily delegate execution to smart contract logic. Under the older setup, such an account acts only through signatures made with its private key. With the standard, the account can run contract logic in its own context and process batched transactions. Each authorization must include the chain ID, the delegate address and the account nonce, plus a cryptographic signature. Network nodes check the signature before applying the delegation. CyberSatoshi acknowledged that rule and concluded the attack required the original private key or unrestricted signing permissions inside the exchange’s systems. Ethereum’s documentation does not say how Binance’s credentials were compromised. The cryptographic requirements do suggest the network will not assign delegations to third-party accounts without a signed authorization.
Batch authorizations and audit gaps
The report says the attacker submitted 50 consecutive authorizations with progressive nonces to front-run transaction sequence changes on the Binance 14 account. Ethereum processes those entries in order, increments the nonce and executes the latest valid delegation. The standard’s authors warn that delegated contracts get unrestricted access to the account’s assets. Wallet software, then, has to audit any authorized code carefully. The delegation stays active until the owner broadcasts an authorization pointing to the zero address. Audits and forensic work are still ongoing to determine how the credentials were compromised.
