What Is EIP-7702? How Wallet Delegation Differs From a Token Approval
EIP-7702 lets a normal Ethereum wallet run smart-contract code. Learn how a delegation differs from a token approval and why it matters for safety.
Many crypto users first heard the term EIP-7702 in the news after a major exchange hot-wallet incident at the end of October 2026. The name sounds technical, but the idea behind it is simple enough to understand without any coding. This article explains what EIP-7702 is, what a "delegation" means, and how it differs from the token approvals most wallet users already know.
What is EIP-7702?
EIP-7702 is a change to Ethereum that went live with the Pectra upgrade on 7 May 2025, according to the Ethereum Foundation's mainnet announcement. It lets an ordinary wallet address (an externally owned account, or EOA) temporarily behave like a smart-contract wallet.
Before this change, a normal address could only do one thing per transaction and could not run its own rules. Smart-contract wallets could, but they required a separate address. EIP-7702 closes that gap. The Ethereum Foundation describes benefits such as bundling several actions into one transaction, letting someone else pay the network fee, using passkeys for authorization, and setting spending limits.
How does a delegation work?
The owner signs an authorization. According to ethereum.org, that authorization contains the address of a smart contract, a chain ID, a nonce and the owner's signature. Once it is applied, your address points to that contract and uses its code.
Three details are worth remembering:
- Your key still controls the account. Ethereum.org notes that the private key keeps full control, so a delegated account is not a multisig.
- A delegation can be replaced or reset. Ethereum.org says it can be reset by delegating to the null address.
- The chain ID matters. A specific chain ID limits the delegation to one network. A chain ID of 0 means it applies on every network, which is why you should never sign one casually.
Delegation vs token approval
People often mix the two up, because both involve "allowing" something. They are very different in scope.
| Token approval | EIP-7702 delegation | |
|---|---|---|
| What you allow | A contract to spend a specific token | An address to use a contract's code as your account's logic |
| Scope | One token, often with a set amount | The whole account, including assets and actions |
| Where it applies | One token contract on one network | One network, or all networks if chain ID is 0 |
| How you undo it | Revoke the allowance | Reset the delegation, usually to the null address |
| Main risk | The approved contract can spend that token | A malicious contract can act with your account's authority |
A useful comparison: a token approval is like giving a shop permission to take one specific payment from your account. A delegation is closer to handing over a power of attorney for the whole account. That is why a malicious delegation can be far more damaging than a malicious approval. If you want a refresher on approvals, see our guide to wallet safety when trading new memecoins.
Is EIP-7702 dangerous?
The standard itself is a legitimate feature, and it is designed with safety measures: delegations can be chain-specific, tied to a nonce and replaced or revoked by the account owner, according to the Ethereum Foundation. We are not aware of any reported bug in the standard itself.
The danger lies in what you are asked to sign. A delegation to a trusted wallet provider's contract is one thing. A delegation to an unknown contract that a website, a message or an "airdrop" pushed you towards is another. Ethereum.org itself warns that delegating to a malicious contract can let an attacker take control of funds.
What the Binance incident does and does not tell us
In reporting on 30 October 2026, CoinDesk said that Binance co-CEO Richard Teng stated the attackers used EIP-7702 account delegation to take control of a hot wallet, and that the full sequence of events had not yet been determined. We covered what is known and disputed in our article on the Binance security incident.
For ordinary users, the lesson is general. A delegation is only as safe as the key that signs it and the process that approves it. Please read Binance's own official updates for the current state of the investigation, as details may change.
What should an ordinary user do?
- Do not sign any request you did not start yourself, especially one described as an "upgrade", "activation" or "verification".
- Learn how to see whether your address has an active delegation. Our guide on how to check and revoke an EIP-7702 delegation walks through it step by step.
- Learn the warning signs of fake requests in our article on EIP-7702 phishing.
- Before you interact with an unfamiliar address or contract, you can check it from your ScamSonnar account, where you can sign up or log in with Google or a magic link.
Wallet features and block explorer screens change quickly, so verify the current behaviour in your own wallet and in the official documentation before you rely on anything written here.
This article is for general information only and is not financial advice.