The address submitting the calls also created the delegate contract. It had received about 0.0983 $ETH from a Tornado Cash pool on Oct. 28.
A Separate Wallet, the Same Authority
The $USDC transfer followed at 4:41:23 p.m. ET. Its token source was the contract labeled “Binance: Hot Wallet 34,” not Binance 14 itself. Whale Alert flagged the movement as a transfer from Binance to an unknown wallet.
The link goes beyond a shared recipient. Etherscan’s read-only contract interface identifies Binance 14 as that smart wallet’s owner. The execution trace shows Binance 14 calling the smart wallet, which then called $USDC to transfer the tokens. Delegated code thus exercised authority over assets held in another account.
Why the Authorization Persists
EIP-7702 lets an ordinary, key-controlled Ethereum wallet execute code stored at another address. Installing that delegation requires a signature from the wallet’s key. Its intended functions include batching operations and allowing someone else to pay transaction fees. The delegation persists beyond the transaction that installs it; subsequent callers can trigger whatever actions that code permits without necessarily obtaining a fresh signature from the wallet’s key.
“The delegation persists; that code can authorize later transfers without another signature from the wallet,” Phylax Systems founder Odysseus wrote in a thread describing the sequence.
Loading post from X…
View post on X
For wallet users, the security boundary is the delegated code, not merely the initial signing prompt. The EIP warns that this code has “unrestricted access to the account” and must be closely audited by wallets. Delegation can be replaced or cleared through a new signed authorization; the protocol specifically supports clearing it by authorizing the zero address.
