Binance hack: EIP-7702 used to drain $2.5B in minutes

Binance confirmed on Friday, October 30, that about $6.3 billion in customer assets was taken across several blockchains, according to CoinCentral, making it the largest theft the crypto industry has recorded. On Ethereum alone, roughly $2.5 billion in ether, tokens and stablecoins left a single exchange wallet in under four minutes on Thursday, October 29.

The attack relied in part on EIP-7702, a feature that shipped with Ethereum’s Pectra upgrade in May 2025. Decrypt reported the overall loss as $6.4 billion and said most of the funds moved within about 20 minutes across 10 blockchains, with analytics firms TRM Labs and Chainalysis attributing the theft to the North Korean group TraderTraitor.

Key facts

• Binance said about $3 billion of the affected assets have been frozen and pledged to cover all losses using its SAFU emergency fund and company money, CoinCentral reported.
• The Ethereum wallet, labeled “Binance 14” on Etherscan, carried 50 pre-signed EIP-7702 authorizations with different transaction counter values; Ethereum accepted the one numbered 18,914,809 and ignored the rest.
• Aside from Ethereum, the attacker moved 18,270 bitcoin, hundreds of millions of XRP, and funds on Solana and Tron through ordinary signed transfers, per TRM Labs.
• Decrypt reported that TRM Labs and Chainalysis both pointed to a compromise of Binance’s hot wallet signing infrastructure rather than a flaw in Ethereum.
• Binance’s own October 30 investigation update on X said an initial finding of a compromised laptop was followed by “additional points of breach.”

How the Ethereum sweep worked

Standard wallets are driven by a private key and cannot enforce rules such as spending caps. EIP-7702, written in May 2024 by Vitalik Buterin, Sam Wilson, Ansgar Dietrichs and lightclient, lets a wallet copy a contract’s code after its owner signs an authorization. The specification warns the borrowed code gets unrestricted access to the account.

Starting Wednesday, the attacker funded a main wallet through Tornado Cash and rehearsed on their own wallets, then deployed a sweeper contract around 16:00 UTC Thursday that only their wallet could operate, CoinCentral reported. At 20:20 UTC a single transaction carried the 50 authorizations, each signed by Binance 14. Four minutes later the attacker moved about 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT, and made further sweeps at 21:04 and 21:44 UTC. TRM Labs said the wallet was also used to order a separate Binance wallet to send out 823 million USDC. The delegation was revoked at 00:10 UTC Friday, nearly four hours after the first sweep.

Decrypt noted that Wintermute had found within weeks of Pectra’s launch that more than 80% of EIP-7702 delegations pointed to copies of the same malicious sweeper contract.

Why it matters

The size of the loss puts it far above earlier exchange breaches, and the fact that nine of the 10 affected chains never touched EIP-7702 shifts attention onto how Binance’s signing systems were reached. Neither outlet published a full attack path. Binance’s co-CEO Richard Teng said early findings pointed to a compromised DevOps engineer’s laptop and that there was no evidence private keys leaked. Security experts split on the upgrade’s role: Blockaid’s Ido Ben-Natan said the theft was possible without it but EIP-7702 let the attacker work in one sweep and may have skirted some checks, while Ambire’s Ivo Georgiev said it made little difference. Holders of delegated wallets should treat any request to sign an authorization as a red flag, since the spec itself says no safe interface for it exists.

What to watch

Binance has not named the additional breach points it says investigators found, nor explained how the signatures were obtained, and its compensation plan through SAFU and company funds has yet to be executed in detail. Clarity on either would change how other exchanges assess their own signing setups.

This article is not financial advice, and crypto markets are volatile and uncertain.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Decrypt