EIP-7702 Explained: How Ethereum Delegation Works and How to Revoke It

Updated October 30, 2026.

EIP-7702 is the Ethereum feature that lets an ordinary wallet borrow a smart contract's code with a single signature. It went live with the Pectra upgrade in May 2025 to make wallets easier to use: several actions in one click, fees paid by someone else, keys with limited powers. Since then, phishing crews have abused the same signature to drain wallets, and on October 29, 2026 it was one of the tools used in the Binance hack.

This guide covers what a delegation is, how authorizations and nonces work, what security firms have documented, and how to check and revoke one on your own wallet.

EIP-7702 explained: the short version

• What it is: an Ethereum standard that lets a normal wallet (an "EOA") point to a smart contract and run that contract's code as if it were its own. It shipped in the Pectra upgrade on May 7, 2025.
• How you turn it on: the wallet owner signs an authorization naming a contract, a chain and the account's current transaction count (its nonce). Anyone can then submit it in a special "type 4" transaction.
• What it's for: batching several actions into one transaction, letting a sponsor pay gas, and handing out limited-permission keys (often called session keys).
• It doesn't expire after one use: a delegation stays in place until the owner signs a new one. Pointing it at the zero address clears it.
• Your key still rules: the private key keeps full control after delegating, so a delegated wallet is no safer than its seed phrase.
• The risk: a malicious authorization gives the attacker's code full access to the account. Wintermute found that more than 97% of early delegations pointed to copies of the same "sweeper" code.
• What to do: never sign an upgrade or delegation that a website asks for, check your address's authorization history on a block explorer, and revoke anything you don't recognize.

What is EIP-7702?

Ethereum has two kinds of accounts. An externally owned account (EOA) is the normal wallet most people use: a private key controls it, and it has no code. A smart contract account is a program that holds funds and can follow custom rules, such as "batch these steps" or "let this other key spend up to a limit."

EIP-7702, titled "Set Code for EOAs," gives the first kind some of the powers of the second without changing your address. Per the official spec, it adds a new transaction type that lets an EOA set a pointer to a contract, so calls to your address run that contract's code. Its authors are Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient, and its status is Final.

The Ethereum Foundation called it "a major step toward widespread account abstraction," the effort to make wallets programmable. MetaMask puts it simply: the account "still remains an EOA," funds don't move, and the seed phrase still controls it.

Where EIP-7702 came from

EIP-7702 was a late replacement. Core developers had planned to ship an older proposal, EIP-3074, in the same upgrade. Buterin and three co-authors posted 7702 in early May 2024 as an alternative, and on the May 23, 2024 core developers call the group agreed to drop 3074 from early Pectra test networks and put 7702 in instead, according to Galaxy's call notes. Its revocation design was still being argued at that point.

The upgrade went live on Ethereum mainnet at epoch 364032, on May 7, 2025 at 10:05 UTC, per the Ethereum Foundation.

How EIP-7702 delegation works

Four parts make it work.

1. The authorization

An authorization is a small signed message. According to the spec, it contains three things plus the signature: a chain ID (which network it's valid on), a contract address (the code you want to borrow) and a nonce (your account's current transaction count). You sign it with the same private key that controls the wallet.

Signing it does nothing on its own. It's a permission slip waiting to be used.

2. The type-4 transaction

To take effect, the authorization has to be included in a new kind of transaction, type 0x04, which carries a list of one or more authorizations. Anyone can submit it: you, your wallet's backend, or a sponsor paying the fee. The spec charges the sender for every authorization in the list, valid or not.

3. The pointer on your account

When the transaction runs, Ethereum writes a tiny pointer into your account: the bytes 0xef0100 followed by the contract address. From then on, when anyone calls your address, the network loads the code at the delegated contract and runs it in the context of your account, with your balance and your storage. That's why block explorers suddenly show 23 bytes of "code" on an address that used to have none.

4. Why the nonce matters

Every Ethereum account has a nonce, a running count of transactions it has sent. An EIP-7702 authorization only works if the nonce inside it matches the account's nonce at the moment the transaction executes. Once it's applied, the nonce goes up by one, so the same signature can't be replayed later.

This is why, according to TRM Labs and Blockaid, the Binance attacker came armed with 50 authorizations signed by the hot wallet's key: the hot wallet's nonce kept climbing, so covering 50 consecutive numbers made sure one would still be valid.

The chain ID catch

By default, an authorization works on one network. The spec also allows a chain ID of 0, which makes it valid on every chain, and ethereum.org warns that this puts the account at risk on all of them at once.

What EIP-7702 enables: batching, gas sponsorship, session keys

Batching

Batching means "multiple operations from the same user in one atomic transaction," in the spec's words. The classic example is approving a token and then swapping it. Before Pectra that was two transactions and two fees. With a delegation, it can be one, and if any step fails, the whole thing reverts. MetaMask notes that batched transactions can cost less because you pay the fee once.

EIP-7702 gas sponsorship

Sponsorship means one account pays the fee for another. The Ethereum Foundation highlighted this for wallets that hold tokens but no ETH: an app can cover the gas. Ethereum.org advises against relying on a single trusted relayer and recommends ERC-4337 bundlers instead.

Session keys and limited permissions

The spec calls this "privilege de-escalation": you can create sub-keys with permissions "much weaker than global access to the account." In practice that means a game or trading app gets a key that can only do one narrow thing, so you aren't approving every click with your main key.

What wallets actually use

Most wallets don't let you pick a contract; they delegate to their own audited code. MetaMask, for one, only supports its own delegator contract. Ethereum.org keeps a list of audited implementations, from MetaMask's Delegation Framework to Uniswap's Calibur and the Ethereum Foundation's Simple7702Account.

EIP-7702 security: what security firms have documented

EIP-7702 doesn't let anyone touch your wallet without a signature. What it changed is how much one signature can do. The spec itself says delegated code gets unrestricted access to the account, and that wallets, not websites, must control when an authorization is signed. "Applications must not expect that they can suggest the user sign an authorization," it says.

Three patterns have shown up in public reports.

Phishing for delegation and batch signatures

Classic drainer scams trick people into signing individual transactions or approvals. A December 2025 academic paper on EIP-7702 phishing describes the new version: a victim signs one authorization tuple, and the attacker gains persistent control of the whole account. The authors studied more than 150,000 authorization and execution events across 26,000 addresses and found authorizations concentrated in a small number of contract families tied to criminal activity.

Batching is a second angle. On May 24, 2025, Scam Sniffer flagged a MetaMask wallet, recently upgraded under EIP-7702, that lost about $146,000. SlowMist found the attacker hadn't swapped in a malicious contract at all. The victim's account still pointed to MetaMask's legitimate delegator, and a phishing batch used it to approve token transfers in one go. SlowMist linked it to the Inferno Drainer group. Scam Sniffer's 2025 report lists an August case where one victim lost $1.54 million to an "EIP-7702 batch" signature that bundled several malicious operations into one.

Sweeper delegations on stolen keys

On May 30, 2025, market maker Wintermute reported that over 97% of all EIP-7702 delegations so far pointed to contracts with the same exact code. It named that code "CrimeEnjoyor." These are sweepers: once an attacker already has a wallet's private key, they delegate the wallet to code that automatically forwards incoming ETH to them.

Sweepers don't break into wallets; they need a key that has already leaked. But they make a leaked wallet much harder to rescue, because funds disappear the moment they arrive. That's what hit World Liberty Financial (WLFI) token holders in September 2025: SlowMist founder Yu Xian called it a "classic EIP-7702 phishing exploit," with private key leakage as the prerequisite. One affected user found that even sending ETH for gas felt risky, because it could be swept too.

The Binance hack: 50 pre-signed authorizations

The largest case so far is the October 29, 2026 Binance theft, which TRM Labs puts at about $6.36 billion across ten blockchains. Only the Ethereum part used EIP-7702. According to TRM Labs and Blockaid:

• At 20:20:59 UTC, one type-4 transaction carried 50 authorizations signed with the key of a Binance hot wallet ("Binance 14"), covering 50 consecutive nonces. Forty-nine were invalid and one matched.
• The wallet was delegated to an unverified sweeper contract that accepted instructions only from the attacker's operator address.
• About three minutes and 24 seconds later, the sweep moved 167,464 ETH, 1.615 billion USDT and dozens of other tokens, roughly $2.5 billion in all by Blockaid's estimate.
• Because a delegation persists, the attacker swept new deposits again over the next few hours.

TRM's assessment is that the root cause wasn't a flaw in EIP-7702 but access to Binance's signing system, since wallets on nine other chains were drained with ordinary transfers. The full Binance hack breakdown has the details. Binance says it has since revoked the delegation.

What EIP-7702 doesn't change

• It can't happen without your key. Every delegation needs a signature from the account's private key. EIP-7702 raises the stakes of a bad signature; it doesn't remove the need for one.
• Revoking doesn't fix a leaked key. Ethereum.org says the private key keeps full control after delegation. If an attacker has your seed phrase, they can simply delegate again.

How to check an EIP-7702 delegation

You don't need a special "EIP-7702 delegation checker." Three checks cover it:

1. Your wallet. In MetaMask, open the account selector, tap the three dots next to the account, then Account details → Smart account. It shows which networks have smart account features turned on. Other wallets with smart account features usually show this in account settings.
2. A block explorer. On Etherscan, address pages have an Authorization List tab that shows active and past EIP-7702 authorizations. Etherscan's site-wide "EIP-7702 Authorizations" page lists each one's authority, delegated address, nonce and validity.
3. The code test. A normal wallet has no code. If an explorer shows code on your EOA beginning with 0xef0100, it is delegated, and the address after that prefix is the contract running on your account. TRM Labs advises treasury teams to alert on exactly this: code at an address that should have none.

Check each network you use. Unless the authorization used chain ID 0, a delegation on Ethereum mainnet doesn't carry over to other networks, and the reverse is also true.

How to revoke an EIP-7702 delegation

Revoking means signing a new authorization that points your account at the zero address (0x000…000). Per the spec, the network then clears the pointer and your account behaves like a plain EOA again. It costs a normal network fee.

• In MetaMask: account selector → three dots → Account details → Smart account, then toggle off each network and confirm the transaction. MetaMask says you can switch back at any time; turning it on again later costs gas again.
• In other wallets: look for a "switch back to standard account" or similar option in account settings.
• If you don't recognize the delegation: assume the key may be compromised. SlowMist's Yu Xian advised WLFI victims to cancel or replace the malicious delegation, then move tokens out. Move them to a brand-new wallet with a new seed phrase.
• If your key is definitely leaked: stop using that address. A sweeper can grab whatever you send, including gas money, and the attacker can re-delegate at any time. Ignore strangers who message you offering "recovery."

EIP-7702 safety checklist

• Only turn on smart account features from inside your wallet's own settings. Ethereum.org says websites shouldn't request EIP-7702 authorizations directly, and the spec says wallets shouldn't offer an interface for them.
• Treat any pop-up asking you to "upgrade," "activate" or "migrate" your account from a website as a red flag.
• Read batch requests. One signature can now carry several approvals and transfers.
• Be wary of anything signed for chain ID 0 or "all networks."
• Ethereum.org says hardware wallets shouldn't expose arbitrary delegation either, so a device asking you to delegate to an unknown contract is a reason to stop.

EIP-7702 FAQ

What is EIP-7702 in simple terms?

EIP-7702 is an Ethereum upgrade, live since May 7, 2025, that lets a normal wallet act like a smart contract wallet. The owner signs an authorization pointing the account at a contract, and calls to the address then run that contract's code. It enables batching, sponsored gas fees and limited-permission keys without changing the wallet address.

What is EIP-7702 delegation?

Delegation is the link between your wallet and the contract whose code it borrows. After a valid authorization, Ethereum stores a 23-byte pointer (the prefix 0xef0100 plus the contract address) on your account. Every call to your address then runs the delegated code with your funds. The delegation stays until you sign a new authorization replacing or clearing it.

Is EIP-7702 safe?

The mechanism works as designed, and your private key keeps full control, so delegating through your wallet's own audited contract is the low-risk path. The danger is signing a malicious authorization or batch, which can hand an attacker the whole account. Wintermute, SlowMist and Scam Sniffer have documented sweeper contracts and phishing batches abusing it since 2025.

How do I revoke an EIP-7702 delegation?

Sign a new authorization that points your account at the zero address, which clears the delegation and restores a plain wallet. In practice, use your wallet's "switch back to standard account" option; in MetaMask it's Account details, then Smart account, then toggle off each network. It costs a normal gas fee and must be done on each network.

How do I check if my wallet has an EIP-7702 delegation?

Open your address on a block explorer such as Etherscan and look at the Authorization List tab, which shows active and past delegations and the contract address. You can also check whether the address shows code starting with 0xef0100. Your wallet's account settings should list which networks have smart account features switched on.

What is EIP-7702 gas sponsorship?

Gas sponsorship lets another account pay your transaction fee. Because anyone can submit a type-4 transaction carrying your signed authorization, an app can cover the gas while your wallet's code runs. It helps people who hold tokens but no ETH. Ethereum.org recommends open ERC-4337 bundlers rather than relying on a single trusted relayer.

How was EIP-7702 used in the Binance hack?

According to TRM Labs and Blockaid, the attacker submitted one transaction with 50 pre-signed authorizations from a Binance hot wallet, covering 50 consecutive nonces so one would match. It delegated the wallet to a sweeper contract, which moved 167,464 ETH and 1.615 billion USDT minutes later. TRM says the root cause was access to Binance's signing system, not an EIP-7702 bug.

Cleus searches the live web and reads sources for you, so you can ask what's changed since this was written. Try it as your uncensored AI research assistant.

Sources

• EIP-7702: Set Code for EOAs (official specification)
• Ethereum Foundation: Pectra mainnet announcement
• Ethereum.org: EIP-7702 guidelines and best practices
• Galaxy: Ethereum All Core Developers Execution Call #188 writeup
• TRM Labs: North Korea steals USD 6.36 billion from Binance
• Blockaid: Binance $5.5B hack analysis
• Cointelegraph: Wintermute's CrimeEnjoyor flags malicious Ethereum contracts
• Cointelegraph: WLFI token holders falling prey to classic wallet exploit
• The Coin Republic: How hackers are exploiting EIP-7702 to drain wallets
• Scam Sniffer: 2025 crypto phishing report
• Qi et al.: EIP-7702 Phishing Attack (arXiv, Dec 2025)
• MetaMask: switch to or revert from a smart account
• Bitcoin.com: Etherscan unveils EIP-7702 tracking
• Cleus: Binance hack explained