One Ethereum Authorization Enabled a $2.5 Billion Binance Wallet Drain

A single EIP-7702 authorization preceded a transfer of assets valued at about $2.5 billion from Binance’s Ethereum hot wallet on Oct. 29, after delegated code was activated on the wallet.

The authorization transaction was submitted at 4:20:59 p.m. ET (20:20:59 UTC) with 50 prepared authorizations for consecutive wallet nonces. One matched. About four minutes later, a call through the wallet moved 167,464 Ether (ETH), 1.615 billion Tether (USDT) and 62 other tokens.

EIP-7702 lets an externally owned Ethereum account delegate code execution to another address. The delegation made it possible to call that code again without a new authorization for each transfer.

Binance 14’s delegation was revoked at 8:10:35 p.m. ET (00:10:35 UTC Oct. 30), nearly three hours and 50 minutes after the authorization transaction.

The broader incident’s estimated impact was about $6.3 billion, about $3 billion had been frozen on-chain, and Binance pledged to cover all losses. The exchange has not explained how the authorization signatures were obtained. It said a technical post-mortem will follow once investigators verify the facts.