EIP-7702 developer: EIP-7702 itself has no vulnerabilities, but it accelerated the transfer of stolen assets from Binance's hot wallet.

ZeroDev founder and EIP-7702-related developer Derek Chiang stated in a post that EIP-7702 itself has no flaws, and users of wallets supporting the standard—including MetaMask, Uniswap, and Ambire—need not panic. The account abstraction proposal allows external accounts to insert smart contracts after signing an authorization, enabling batch transactions such as one-click authorization and swaps. However, this same functionality lets attackers transfer all tokens in a single transaction. In the Binance hot wallet breach, attackers exploited this to siphon ETH, USDT, and 62 other tokens in one transaction. Without EIP-7702, attackers would have had to initiate separate transactions for each token, potentially competing with the exchange’s normal withdrawals for nonce values, so EIP-7702 enabled attackers to steal funds faster and in larger volumes. Chiang noted that for attackers to use EIP-7702, they either need access to a private key or to trick Binance into signing an EIP-7702 authorization; the latter scenario is unlikely but cannot be ruled out ahead of the official post-mortem. His advice to wallet developers and hot wallet operators: never expose interfaces that request EIP-7702 authorization or sign raw messages to the public, and users should opt for well-known wallets.