Binance Hack Used Ethereum EIP-7702 to Sweep $2.5 Billion

An Ethereum wallet authorization using EIP-7702 enabled a single $2.5 billion sweep during the Oct. 29 Binance breach, showing how the network feature let attackers move assets from an exchange hot wallet in one transaction.

A transaction at 4:20:59 p.m. ET (20:20:59 UTC) contained 50 authorizations signed by Binance’s “Binance 14” wallet. One matched the wallet’s nonce and delegated it to attacker-controlled code. Three minutes and 24 seconds later, a sweep transferred 167,464 Ether (ETH) and tokens including 1.615 billion Tether (USDT), valued at about $2.5 billion at the time.

The $2.5 billion figure covers the first sweep; total Ethereum outflows were estimated at about $3.79 billion. Transfers across 10 blockchains were valued at about $6.36 billion at transfer-time prices, with most occurring in roughly 20 minutes from 4:05 p.m. ET (20:05 UTC). Binance put the incident’s impact at about $6.3 billion.

The delegation remained active until about 8:10 p.m. ET (00:10 UTC Oct. 30), allowing repeated sweeps as deposits arrived. The exchange estimated the incident’s impact at about $6.3 billion. Binance said about $3 billion had been frozen on-chain and pledged to cover losses with its SAFU fund and company funds. It has not disclosed how attackers obtained the authorizations or published a root cause.

EIP-7702 lets an Ethereum account delegate code execution through a signed authorization. The feature explains how the wallet could be swept, but not how the signatures were obtained.