Skip to main content
Binance Hot Wallet Drained via EIP-7702 Delegation
Security
Security
5 min read9 views

Binance Hot Wallet Drained via EIP-7702 Delegation

Floriano Righetti
Floriano Righetti

On 29 October 2026, Binance suffered a security incident that it estimates at a total impact of around $6.3 billion. CNBC and TRM Labs describe it as the largest crypto theft on record. In its official update, Binance said its initial investigation suggests a compromised DevOps engineer's laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The exchange said it found "no evidence of any wallet private key leak", that around $3 billion had been frozen on-chain, and that it will cover all losses from its SAFU fund and company funds. We reviewed the Ethereum part of the incident directly on-chain, and below we separate what we could verify from what is still open.

The Ethereum sequence, verified on-chain#

Using a public Ethereum node, we confirmed the following (all times UTC, 29 October):

  • 20:20:59, block 26,300,753: a type-4 (EIP-7702) transaction, 0xad99264d…51298b, sent from the address 0x7c8601d4…6b5ca0 to the Binance hot wallet 0x28c6c062…f21d60, carried 50 signed authorizations. Their nonces run consecutively from 18,914,775 to 18,914,824, and all of them point the wallet's code at the same contract, 0x63e842b0…9c6fae. Blockaid's analysis, as reported by crypto.news, explains the pattern: the wallet was busy processing withdrawals, so its next nonce could not be predicted exactly, and only an authorization matching the live nonce takes effect.
  • 20:24:23, block 26,300,770: the same operator address called a function on the now-delegated wallet (selector 0x8a179be4, which Blockaid identifies as sweep()). In that single transaction, 1,615,409,498.97 USDT moved to the collection address 0x5227f603…cb2f8c, along with ETH and dozens of other tokens.
  • 21:04:59, block 26,300,971: Circle blacklisted 0x5227f603…cb2f8c on the USDC contract. When we checked, that address held 823,000,000 USDC, and Tether's USDT contract also reports it as blacklisted.
  • 21:44:11, block 26,301,167: a follow-up sweep through the same function moved another 200,397,771.82 USDT to the same collection address.
  • Today: the hot wallet's code is empty again, which is consistent with Binance's statement that it "revoked the affected address authorisation."

TRM Labs, as reported by CryptoSlate, traced a wider operation across ten networks. According to TRM, roughly $296 million in XRP left Binance wallets between 20:05 and 20:09 UTC, followed by 18,270 BTC and transfers on Tron, Solana, Optimism and other chains, for about $6.36 billion in traced transfers. We have not independently verified the non-Ethereum legs.

What is known and what is not#

Known: on Ethereum, the attacker turned a standard exchange hot wallet into a contract-controlled account through EIP-7702 delegation, then emptied it with a single call. Stablecoin issuers froze large balances within hours: Tether and Circle both blacklisted the collection address. Binance co-founder Yi He also said the Arbitrum Security Council froze about $30.5 million. Native assets such as BTC and ETH have no issuer that can freeze them, which is why the frozen share is so concentrated in stablecoins.

Not yet known: how the attacker obtained valid authorizations. Under EIP-7702, an authorization only takes effect if it is signed by the account itself, and its nonce must match the account's current nonce. Binance's statement that there is no evidence of a key leak is not necessarily a contradiction: a compromised service that can request signatures can obtain valid ones without the key ever being exported. That remains a hypothesis. Binance has not said which system produced these authorizations. In a later service update, it said the incident "stems from multiple factors" and that a comprehensive report with the root cause will follow. Withdrawals remain paused while Binance revamps its withdrawal service, and it expects to resume them within 48 hours. Its reported frozen total has moved from $2.54 billion to around $3 billion, and may change again.

Why this matters#

We see two lessons for anyone operating custody infrastructure. First, EIP-7702 changes what a signature from a hot-wallet key can authorize. A signing service that will sign an authorization tuple, and not only a transfer, can hand over full control of the account, including funds that arrive later. Policy engines should treat delegation authorizations as a separate, high-risk message type, and monitoring should alert whenever a managed account's code changes. Second, the boundary between an engineer's workstation and a service that can submit withdrawals is a critical control. By Binance's own preliminary account, that boundary is where this incident appears to have begun.

We will update this analysis when Binance publishes its technical post-mortem.

Sources#

Share this article

Related Articles