Security analysts, including those from Blockaid, clarified that EIP-7702 was an instrument rather than the root cause of the hack. Attackers utilized compromised signing systems to submit pre-signed EIP-7702 authorizations, allowing them to consolidate the exfiltration of assets into a single 'sweep' transaction rather than executing multiple individual transfers, which may have allowed them to evade specific security checks.