From Decrypt · By Decrypt Agent
In brief
EIP-7702 is an Ethereum upgrade, activated in May 2025, that lets standard wallets temporarily take on the abilities of smart contracts.
It enables batched transactions, gas sponsorship and limited-permission keys, but delegated code gets full access to the wallet's funds.
An attacker used EIP-7702 in October 2026 to drain a Binance hot wallet during a $6.4 billion hack that analysts attributed to North Korea.
Ethereum has two kinds of accounts. Externally owned accounts (EOAs), the standard wallets most people use, are controlled by a private key and can do little more than send transactions. Smart contract accounts can run code, enabling features like spending limits, account recovery and paying fees in tokens other than ETH, but most users never moved to them.
EIP-7702 is an attempt to bridge that gap. Instead of asking users to migrate to new wallets, it lets existing EOAs borrow the code of a smart contract while keeping their address and funds.
This guide explains what EIP-7702 is, how it works, why developers wanted it, and how attackers used it in the largest crypto theft on record.
What is EIP-7702?
EIP-7702, titled "Set Code for EOAs," is an Ethereum Improvement Proposal written in May 2024 by Ethereum co-founder Vitalik Buterin and developers Sam Wilson, Ansgar Dietrichs and lightclient, according to the official specification.
It was one of the headline changes in Pectra, a major Ethereum upgrade that went live on May 7, 2025.
"EIP-7702 lays the foundation we've needed for a long time," Ethereum core developer Preston Van Loon told Decrypt at the time. "While full abstraction won't be immediately available to end users with Pectra, this upgrade gives Ethereum the infrastructure to support it moving forward."
EIP-7702 is a change to Ethereum's core protocol, not a token or a separate blockchain, so there is nothing to buy.
How does EIP-7702 work?
EIP-7702 adds a new type of Ethereum transaction, the "set code transaction." It carries a list of authorizations, each signed with the private key of the account being upgraded, that names the address of a smart contract the account wants to use.
Once the transaction is processed, the account stores a small pointer, called a delegation indicator, to that contract. From then on, whenever anyone calls the account, Ethereum runs the contract's code as if it belonged to the account, with full access to its funds.
The delegation lasts until the account owner signs a new authorization, either pointing to a different contract or clearing the pointer to restore a plain EOA.
Did you know?
EIP-7702 marks delegated accounts using the byte 0xef, a code value that was banned in earlier upgrades so it could be reserved for special purposes like this.