Last updated: October 30, 2026
EIP-7702 is an Ethereum upgrade, live since the Pectra hard fork in May 2025, that lets an ordinary wallet address delegate to smart-contract code with a single signed authorization, so the address can batch transactions, have its gas paid by someone else or use passkeys. The catch: whoever controls the delegated code controls the wallet. Drainers phish for these signatures, and in October 2026 attackers used pre-signed EIP-7702 delegations to turn a Binance hot wallet into a sweeper during the $6.3 billion hack. Below: how it works, what can go wrong and how to check and remove a delegation.
- May 2025 live on Ethereum (Pectra)
- 1 signature to delegate a wallet
- Persists until you change it
- chain_id 0 = valid on every EVM chain
How EIP-7702 works
Before EIP-7702, an Ethereum address was either a normal wallet controlled by a private key (an EOA) or a smart contract with its own code. EIP-7702 adds a third option: your normal wallet signs an authorization pointing to a contract, and from then on your address runs that contract's code while you keep your private key.
| Part of an authorization | What it means |
|---|---|
| Contract address | The code your wallet will run from now on |
| Chain ID | Which chain it's valid on; 0 means every EVM chain that supports EIP-7702 |
| Nonce | Which transaction number it applies to; it can be pre-signed for future numbers |
| Your signature | Signed with your private key, so it's as powerful as the key itself |
The authorization is included in a special transaction that anyone can submit, not just you. Once processed, the delegation stays until you replace it or reset it.
What it's good for
- Batching: approve and swap in one transaction instead of two.
- Sponsored gas: an app or a paymaster pays the fee, so a wallet can hold only USDC.
- Better security options: spending limits, session keys, passkeys and recovery — features that used to need a separate smart-contract wallet.
Major wallets use it for "smart account" features. That is fine when the contract is the wallet maker's own audited code, and dangerous when it's anyone else's.
How attackers abuse it
- Phished delegations. A fake site asks you to sign what looks like a login or an upgrade. It is really an authorization to a "sweeper" contract that forwards everything — current funds and anything sent later — to the attacker. In 2025, researchers found that most early delegations on Ethereum pointed to copies of the same sweeper code.
- Every chain at once. An authorization with chain ID 0 works on all EVM chains that support EIP-7702, so a single signature can expose the same address on several networks.
- Pre-signed for the future. In the Binance hack, the attacker prepared 50 authorizations for 50 consecutive nonces, so one was sure to match the wallet's next transaction.
- Hidden in a normal-looking request. Wallets that don't clearly display delegation requests leave you signing something you can't read — see blind signing explained.
A delegation doesn't need any token approval, so revoking approvals won't remove it. It's a separate check — see how to revoke token approvals.
How to check and remove a delegation
- Look up your address in a block explorer such as Etherscan. A delegated address shows that it is delegated to a contract.
- Check your wallet's settings. Wallets with smart-account features show whether the account is upgraded and let you switch back.
- Don't recognise the contract? Treat the wallet as compromised. Move everything to a brand-new wallet with a new seed — a sweeper may grab funds faster than you can act, and the attacker may have more signatures prepared.
- To reset a delegation you created on purpose, sign a new authorization to the zero address in a wallet that supports it. That clears the code from your address.
How to stay safe
- Only accept smart-account upgrades inside your wallet app, never from a website pop-up.
- Read what you sign. A login should never need an authorization or a transaction.
- Use a hardware wallet that clearly shows delegation requests, and keep savings on it.
- Keep a separate wallet for connecting to new apps, with only what you need — and watch for wallet drainer scams.
Frequently asked questions
What is EIP-7702 in simple terms?
It lets a normal Ethereum wallet run smart-contract code, until the delegation is changed, by signing an authorization. That enables batching, sponsored gas and passkeys, but the contract you delegate to gets full control of the address.
Is EIP-7702 dangerous?
The feature is safe when your wallet delegates to its own audited code. It becomes dangerous when you sign an authorization from a website, because a malicious contract can drain the wallet and anything sent to it later.
How was EIP-7702 used in the Binance hack?
According to TRM Labs, the attacker pre-signed 50 delegations for 50 consecutive nonces of a Binance hot wallet. One matched, the wallet started running the attacker's sweeper contract, and its ETH and tokens were drained, including new deposits.
How do I know if my wallet is delegated?
Check your address on a block explorer like Etherscan or in your wallet's account settings. If it's delegated to a contract you didn't choose, move your funds to a new wallet immediately.
Does revoking token approvals remove a delegation?
No. Approvals and delegations are separate. Revoking approvals stops contracts from spending specific tokens; a malicious delegation has to be removed by resetting it or, if it was phished, by abandoning the wallet.
Swapping doesn't require signing anything on a website: on /swap you just send coins to a deposit address from your wallet — for example ETH → XMR. No account, no ID, no logs.