EIP-7702 explained by MEXC Learn

why a delegation is far riskier than a token approval, and how to check your wallet in a minute

By Alexander F., Portfolio Manager @ LiquidityFlow.ioUpdated 2026-10-30

Key takeaway

After a big exchange hot wallet was drained on October 29 through an Ethereum feature called EIP-7702, a lot of people are asking whether their own wallet is exposed. MEXC Learn's explainer is a calm answer: probably not, unless you signed something.

Official MEXC Learn cover art for its EIP-7702 explainer, showing a bitcoin coin dropping into a graduation cap with a tether coin floating above on a dark blue background. — Image: MEXC official article image, as used in the original post.

The image is MEXC Learn's cover art for the article, a bitcoin coin dropping into a graduation cap. It's illustration only.

What EIP-7702 is

It's part of Ethereum's Pectra upgrade, live since May 7, 2025. It lets a normal wallet borrow smart contract code and act like a smart account. You sign an authorization naming a contract, the chain and your nonce, and from then on calls to your address run that contract's code. Your private key still controls the account, and you can undo it by delegating to the zero address.

The useful parts: batching several actions into one transaction, letting someone else pay gas, and sub-keys with narrow permissions.

Why it's different from an approval

A token approval lets one app move one token. A delegation hands the logic of your whole account to a contract until you reset it. The article's analogy: an approval is giving someone the key to one cabinet, a delegation is hiring a manager who runs every room.

What happened this week

Signed authorizations pointed the exchange's wallet at an attacker's contract, and one transaction swept it minutes later. As of October 30, no bug in EIP-7702 itself had been reported, and the root cause hadn't been published. The open question is whether a key leaked or a signing system approved an authorization without decoding it.

Is your self-custody wallet at risk?

Only if you signed a delegation. Holding ETH doesn't switch anything on, and anyone telling you to "upgrade" your ETH is running a scam. The real threat is phishing pages that disguise an authorization as a routine prompt. Etherscan reported in mid-2025 that over 97% of delegations were linked to scams.

How to check, step by step

Paste your address into Etherscan and look at the Delegated Address field. "Null" means nothing is delegated
A known wallet contract just means you turned on that wallet's smart account feature
An unknown contract: revoke it in your wallet app, which delegates back to the zero address
Repeat on other EVM chains where you use the same address, since an authorization signed with chain ID 0 is valid on all of them
If you don't remember signing it, assume the seed phrase is exposed and move everything to a fresh wallet. Revoking won't help if someone else holds your key

The bottom line from MEXC Learn: the feature is final and isn't going away, so the safety lives in what you sign.