Cos says Binance attacker used EIP-7702 on Ethereum only to make bulk sweeping easier, with rough execution and prior rehearsals
On October 30, 2026, SlowMist founder Cos (@evilcos) posted that the Binance hacker chose the EIP-7702 mechanism on Ethereum only to make the sweeping work easier (bulk stealing tokens from Binance-related hot wallets). He said that, from on-chain data, the hacker’s operations were very rough, and that before the actual theft of tokens, they had also done a few hours of rehearsal and preparation work. He provided a transaction-record link for address 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, pointing out that the first five records showed the related preparations.
Cos said that the EIP-7702 mechanism itself is fine, and that even without this protocol mechanism, there are other ways to achieve a similar effect.
Earlier on-chain analysis showed that the attacker delegated 14 Binance wallets through EIP-7702, causing them to run a sweeping contract deployed by the attacker. Binance has officially said user funds are safe and that it will cover all hacker losses. The total amount frozen so far has been verified at about $3 billion, and deposits and withdrawals are temporarily suspended.
Original source:
Title: Binance hacker chose the EIP-7702 mechanism on Ethereum only to make sweeping work easier Publisher: Cos (余弦) (@evilcos) Publication date: 2026-10-30 URL: https://x.com/evilcos（用户提供原帖内容） Source nature: security researcher original post Verification status: related content read in this issue, verification date 2026-10-29 Supporting content: Cos said the attacker used EIP-7702 only to make bulk sweeping easier, with rough execution and prior rehearsals, and that the mechanism itself is fine
ABAB AI Insight
Cos’s comment frames the use of EIP-7702 as a sweeping tool rather than a protocol vulnerability. Before the actual transfers out, the attacker conducted a few hours of rehearsal, including deploying contracts on their own test wallet and running sweeping tests. This path corresponds to the preparatory transactions visible on-chain, rather than a last-minute operation.
On the capital path, EIP-7702 allows an externally owned account to temporarily delegate execution of specific contract code; after signature authorization, the wallet is taken over by that code until revoked. The attacker used this mechanism to sweep multiple tokens in a single transaction. Binance has officially verified that about $3 billion has been frozen and has pledged to cover all losses. The unfrozen portion still depends on subsequent tracing.
Unlike attributing the incident to a protocol defect, Cos emphasized that the mechanism itself has no problem and that other methods can also achieve a similar sweeping effect. The observation points are whether Binance confirms in its post-incident analysis the signature system or private-key control path, and whether revocation of delegation for the relevant hot wallets has been completed.
ABAB News · Laws of cognition
Using EIP-7702 as a sweeping tool does not mean the protocol itself has a vulnerability; similar effects can also be achieved through other authorization paths.
On-chain rehearsal before the attack is an observable preparatory behavior and is independent of the timeline of the actual transfers out.