Blockaid CEO Says Binance Attack Did Not Depend on EIP-7702

Blockaid CEO Ido Ben-Natan said EIP-7702 may have let attackers move assets in fewer steps during Binance’s $6.3 billion hack. Ambire CEO Ivo Georgiev said the upgrade made little difference.

Ido Ben-Natan, co-founder and CEO of blockchain security firm Blockaid, said Friday that attackers could have taken the funds through other methods. He said EIP-7702 may have let them complete the transfer in fewer steps and possibly avoid some withdrawal checks.

Binance expanded its inquiry after initially focusing on a potentially compromised engineer’s laptop, and the exchange identified additional breach points. CEO Richard Teng said investigators found no evidence of a wallet private-key leak. The exchange previously described the laptop as a possible access route in its preliminary incident findings.

Ethereum introduced EIP-7702 in May 2025 as part of its Pectra upgrade. The change lets regular wallets use smart-contract functions, including bundled transactions and sponsored gas fees.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said the upgrade made little difference because attackers already had other ways to authorize transactions. He warned that engineers restoring control of their systems could overlook the need to revoke a malicious EIP-7702 delegation.

Ben-Natan said transaction simulation could help identify malicious requests before a signer approves them.