EIP-7702 developer: EIP-7702 itself has no vulnerabilities, but it accelerated the transfer of stolen assets from Binance hot wallet.

October 30: Derek Chiang, founder of ZeroDev and a developer involved with EIP-7702, stated that EIP-7702 itself is not flawed, and users of wallets such as MetaMask, Uniswap, and Ambire that already support the standard need not panic. The proposal is a form of account abstraction that allows externally owned accounts to sign authorizations and insert smart contracts, enabling batch transactions, such as one-click approval and swap. However, the same capability also allows attackers to transfer all tokens in a single transaction. In the Binance hot wallet theft incident, the attacker used this to transfer ETH, USDT, and 62 other tokens in one transaction; without 7702, transactions would have to be initiated token by token, and could also compete with the platform's normal withdrawals for nonces, so 7702 helped the attacker steal funds faster and in greater quantities.

Derek Chiang stated that for an attacker to use 7702, they must control the private key or trick Binance into signing a 7702 authorization; the latter is very unlikely, but cannot be ruled out before the official post-mortem. For wallet developers and companies operating hot wallets, his advice is never to expose interfaces that request 7702 authorization or sign raw messages externally, and users should choose well-known wallets.