Attackers exploited Ethereum's EIP-7702 upgrade to steal $6.4 billion from Binance wallets on October 29, 2026. The EIP-7702 upgrade, which allows ordinary Ethereum wallets to temporarily run smart contract code, was used to turn a Binance hot wallet into a "sweeper" contract. The attacker, identified as North Korean hacking group TraderTraitor, submitted 50 pre-signed authorizations to enable the hot wallet to run attacker-deployed code, sweeping its assets into controlled addresses. While EIP-7702 delegations require a valid signature, the incident points to a compromise of Binance's hot wallet signing infrastructure rather than a flaw in Ethereum itself. Binance's investigation began with a compromised engineer's laptop and has since found "additional points of breach."