Binance Hack: Ethereum EIP-7702 Exploit Drains $2.5 Billion

5 min read

An attacker exploited Ethereum’s EIP-7702 wallet feature on 29 October 2026, draining approximately $2.5 billion from a Binance hot wallet in less than four minutes. According to CoinDesk, the incident formed part of a wider $6.3 billion cryptocurrency theft spanning several blockchains.

Binance has pledged to cover the losses using its emergency SAFU fund and company resources. The exchange also reported that approximately $3 billion in affected assets had been frozen, although investigators have not established the complete method used to obtain the authorisations.

How Ethereum Wallet Permissions Enabled Theft

The Ethereum portion of the attack relied on EIP-7702, a feature introduced through the Pectra network upgrade in May 2025. It allows a conventional Ethereum wallet to delegate execution to smart-contract code without becoming a separate smart-contract account.

The feature was designed to support capabilities including batched payments and transactions in which another party covers network fees. However, an authorisation directing a wallet towards malicious code can give an attacker control over how its funds are transferred.

Unlike a conventional payment authorisation specifying a recipient or amount, the delegation determines which contract code the account executes. That distinction matters because a malicious contract can potentially move funds already held in a wallet and assets deposited afterwards.

According to Hokanews, citing blockchain security firm Blockaid, the attacker targeted the Binance 14 hot wallet using a deliberately prepared set of signed permissions.

Fifty Authorisations Targeted One Wallet

The attacker submitted 50 signed authorisations in a single Ethereum Type-4 transaction. Each used a different nonce, the transaction counter that must match the account’s current state for an authorisation to become valid.

The submitted nonce values ranged from 18,914,775 to 18,914,824. Because Binance 14 was processing frequent transactions, the attacker could not rely on a single counter value remaining current when the malicious transaction reached the blockchain.

CoinDesk’s examination of Etherscan records established that nonce 18,914,809 matched the wallet’s state. Ethereum accepted that authorisation and disregarded the other 49, allowing an attacker-controlled contract to become active.

The mechanism required valid signatures associated with the Binance wallet. The ability to submit many permissions did not eliminate Ethereum’s signature requirements; it allowed the attacker to accommodate changes in the wallet’s transaction counter.

Malicious Contract Swept Cryptocurrency Funds

CoinDesk identified the initial malicious authorisation transaction at 20:20:59 UTC. The attacker subsequently executed the delegated contract at 20:24:23 UTC, transferring approximately 167,464 ETH and 63 additional tokens, including roughly 1.6 billion USDT.

Blockaid’s technical findings, described by Hokanews, identified a malicious contract containing a `sweep()` function. Only an attacker-designated address could execute that function, which was capable of transferring ETH and ERC-20 tokens while leaving 1 ETH for transaction fees.

The compromised wallet subsequently received further customer deposits through Binance’s normal operations. CoinDesk documented additional withdrawals at 21:04 and 21:44 UTC, demonstrating how the delegation exposed incoming assets as well as funds previously held.

The attacker also used the compromised account’s delegated functionality to issue instructions affecting another Binance smart wallet, Hot Wallet 34. According to TRM Labs, cited by CoinDesk, this enabled the removal of 823 million USDC.

Binance 14 remained subject to the malicious delegation for nearly four hours. The exchange revoked the authorisation at 00:10:35 UTC on 30 October, removing the attacker’s delegated code from the affected account.

Binance Investigates Wider Security Breach

The Ethereum exploit explains only part of the incident. According to Cointribune, citing TRM Labs, attackers transferred cryptocurrency across ten blockchains, with most of the stolen assets moving within approximately twenty minutes.

Other affected networks included Bitcoin, Solana and Tron. Those transfers did not depend on EIP-7702, indicating that the Ethereum delegation mechanism alone cannot explain the broader compromise.

Binance co-chief executive Richard Teng said preliminary findings pointed towards a compromised DevOps engineer’s laptop, potentially allowing unauthorised access to a service container used in withdrawal operations.

“The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng wrote on X. “It involved a more complex attack process.”

Teng said investigators had found no evidence that wallet private keys had leaked. Binance subsequently identified additional possible breach points beyond the initially suspected laptop, making the security investigation broader than its first technical explanation.

North Korean Hackers Become Leading Suspects

Blockchain intelligence company TRM Labs attributed the attack to TraderTraitor, a group associated with North Korea, with high confidence, according to Cointribune. The assessment drew on transaction activity and similarities with earlier operations.

Cryptocurrency investigator ZachXBT also identified funds from the Binance attack and a previous Bitget breach arriving at a common address. The overlap provides investigators with a potential connection but does not independently establish that the same individuals conducted both attacks.

Cointribune reported that preparations included small transfers from Tornado Cash and testing activity before the main theft. These findings add evidence of advance planning rather than an opportunistic transaction executed without preparation.

Binance has not officially confirmed responsibility for the attack.

Frozen Assets and Recovery Challenges

According to Cointribune, TRM Labs initially identified approximately $2.7 billion in frozen assets following interventions involving stablecoin issuers and Arbitrum’s security council.

The distinction between freezing and recovering cryptocurrency remains important. Centralised token issuers can restrict certain assets, whereas Bitcoin and Ether cannot ordinarily be frozen directly by an issuer.

TRM Labs estimated that attackers still controlled more than 420,000 ETH and 18,270 BTC, together valued at approximately $2.4 billion at the time of its analysis.

Investigators now face two connected challenges: tracing the remaining assets across blockchain networks and determining how valid signing authority was obtained from Binance-controlled systems. The latter finding will be central to explaining why a wallet feature designed to extend Ethereum functionality became part of a much larger exchange security failure.