An attacker used Ethereum's EIP-7702 feature to drain about $2.5 billion from a Binance wallet in less than four minutes on Thursday. Binance puts total losses across several blockchains at $6.3 billion and has pledged to cover them. Investigators are still examining how the attacker obtained the signatures.
A Binance wallet signed a permission on Thursday that let an attacker-controlled contract operate it. Less than four minutes later, about $2.5 billion in ether and tokens was gone.
That was only part of the roughly $6.3 billion Binance says was stolen across several blockchains. On Ethereum, the attacker used EIP-7702, which went live in May 2025 as part of the Pectra upgrade.
How EIP-7702 let a wallet run foreign code
EIP-7702 lets an ordinary wallet borrow the code of a smart contract. The wallet signs a short message, called an authorization, that points at that contract, and the wallet then runs the contract's code as if it were its own.
The feature was meant to let everyday wallets batch payments and have someone else pay their fees. However, market maker Wintermute found within weeks of launch that most EIP-7702 delegations pointed at copy-pasted "sweeper" scripts.
Fifty signed authorizations, one accepted
At 20:20:59 UTC, the attacker sent one transaction carrying 50 authorizations. The wallet Etherscan labels "Binance 14" signed every one, and each pointed the wallet at the attacker's sweeper contract.
Binance 14 was processing so many withdrawals that its transaction counter kept changing. The attacker then prepared 50 permissions covering consecutive numbers, from 18,914,775 to 18,914,824. The network accepted the one numbered 18,914,809 and ignored the other 49.
At 20:24:23 UTC, the attacker called the sweeper and moved about 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT. Binance's systems kept routing customer deposits into the wallet, and the attacker swept them out again at 21:04 and 21:44 UTC.
The attacker also pulled 823 million USDC out of a separate Binance smart wallet, Hot Wallet 34, TRM Labs said. Binance 14 revoked the permission at 00:10:35 UTC Friday, after nearly four hours under the malicious delegation.
Investigators still seek the signatures' origin
The attacker also moved 18,270 bitcoin, hundreds of millions of XRP and funds on Solana, Tron and other networks. Those chains do not use EIP-7702, according to TRM Labs.
Binance co-CEO Richard Teng said Friday that preliminary findings pointed to a compromised DevOps engineer's laptop. Binance later said investigators had uncovered additional points of breach, but it did not identify them.
Binance has put the total damage at $6.3 billion and pledged to cover all losses using its SAFU emergency fund and company funds. It said about $3 billion of the affected assets had been frozen.
Source: CoinDesk
Trading involves risk.
Risk Disclaimer
