A roadmap of the suspected Binance theft suggests the theft was caused by a malicious EIP-7702 delegation code being installed on a Binance-linked Ethereum hot wallet. The hacker then used this code to transfer assets. EIP-7702 is a feature in Ethereum that allows ordinary accounts to delegate code execution. If a wallet authorizes malicious code, this code could gain significant account control privileges.