The study says about 63%of EIP-7702 authorizations involved malicious contracts, prompting comparison with the Binance hot-wallet incident
BIBIBI
AT A GLANCE
The report says that approximately 63%of the EIP-7702 authorizations in the study sample were related to malicious contracts and associated with the Binance hot-wallet abnormal outflow.
BlockBeats reports that October 30，USENIX Security’s 2026 empirical study found that, among approximately seven chains’ early 3660000 authorization transactions, about EIP-7702 were related to malicious contracts. Previously confirmed losses exceeded 63%, and 2300000 USD malicious contracts were identified. Most attacks used phishing to induce users to sign authorizations, delegating wallets to asset-sweeping contracts. The study directly parallels today’s 924 hot-wallet abnormal outflow incident.
On-chain analysis shows that attackers used Binance-signed Binance 14 authorizations from hot wallets such as EIP-7702 to delegate them to pre-deployed malicious sweeper contracts, which then transferred assets in batches within minutes (multiple-source estimates put the amount at tens of billions in USD; Tether, Circle, and others have frozen some stablecoins). Whether the cause was private-key leakage or abuse of the signing system, the incident confirms the core risk identified by the study: once a valid authorization signature is obtained,EIP-7702 can give attackers persistent execution control over the account until revoked.
Original link https://m.theblockbeats.info/flash/374519
Key points
01
BlockBeats reports that USENIX Security analyzed approximately 2026 authorization transactions from the early period of seven chains in a 3660000 EIP-7702 empirical study.
02
The study found that approximately 63%of the sample transactions were related to malicious contracts and identified 924 malicious contracts.
03
The article says that previously confirmed losses exceeded 2300000 USD。
04
The article says that most attacks used phishing to induce users to sign authorizations, then delegated wallets to asset-sweeping contracts.
05
The article says that attackers used authorizations signed by Binance 14 and other hot wallets,EIP-7702 delegating the wallets to pre-deployed malicious sweeper contracts, which then transferred assets in batches within minutes.
06
The article says that multiple-source estimates put the amount at tens of billions in USD, and that Tether, Circle, and others have frozen some stablecoins.
07
The article states that a valid authorization signature can allow attackers to continue executing account operations until the authorization is revoked.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
EIP-7702 An authorization can allow a wallet to delegate execution capabilities to a contract. The risk described in the report is that once a user or wallet system signs a malicious authorization, a sweeper contract may continue operating the account and transferring out assets until the authorization is revoked.
Why it matters to readers
The report links a high proportion of malicious authorization samples to the hot-wallet abnormal outflow, suggesting that authorization signatures, contract identification, and revocation mechanisms may be important aspects of wallet security.
Beginners should not view authorization merely as a one-time confirmation; before signing, they should verify the authorization target and beware of phishing pages and unknown contracts.
Risks and unknowns
Evidence not attached USENIX Security’s original study was not provided, so the sample scope, statistical methods, and the basis for the approximately 63%figure cannot be verified.
No on-chain transactions, malicious contract addresses, or independent analytical materials were provided, so the reported attack chain cannot be verified.
The cause of the Binance hot-wallet abnormal outflow has not been confirmed; private-key leakage and abuse of the signing system are merely possibilities listed in the article.
“Tens of billions in USD terms” comes from unattributed multiple-source estimates; the actual asset outflow and loss amount are unknown.
Related Developments
Loading event timeline…
No official statements from Binance, Tether, or Circle were attached, so the affected wallets and the scale of the freezes cannot be confirmed.
Related concepts
Authorization transactions
This term is not in the glossary yet. Browse related concepts in the glossary.
