TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
An attacker used Ethereum’s EIP-7702 feature to make Binance’s wallet Binance 14 run malicious code, moving about $2.5 billion in ether and tokens in less than four minutes. Binance says the broader theft across several blockchains totaled $6.3 billion and that it will cover the losses; investigators are still examining how the attacker obtained valid wallet signatures.
An attacker used Ethereum’s EIP-7702 feature to make a Binance-controlled wallet run malicious code, transferring about $2.5 billion in ether and tokens in less than four minutes on Thursday, according to a CoinDesk reconstruction of blockchain activity. Binance says the wider theft across multiple blockchains totaled $6.3 billion and has pledged to cover the losses; how the attacker obtained the valid signatures remains under investigation.
The Ethereum wallet, identified by Etherscan as Binance 14, signed 50 authorizations pointing to a contract controlled by the attacker. The permissions covered consecutive transaction-counter values, or nonces, from 18,914,775 to 18,914,824. CoinDesk’s review of Etherscan data found that Ethereum accepted only the authorization matching the wallet’s current nonce, 18,914,809, and ignored the other 49.
At 20:24:23 UTC Thursday, the attacker called the contract through Binance 14. That transaction transferred about 167,464 ether and 63 tokens, including roughly $1.6 billion in USDT, to the attacker. Binance continued routing customer deposits into the wallet, which the attacker swept in further transactions at 21:04 and 21:44 UTC. TRM Labs said the attacker also used the delegated code to order Binance’s Hot Wallet 34 to send out about $823 million in USDC.
The delegation stayed active for nearly four hours. Binance 14 revoked it at 00:10:35 UTC Friday. The Ethereum theft was one part of a larger incident: according to the report, the attacker also moved bitcoin, XRP and funds on Solana, Tron and other networks. Those transfers did not use EIP-7702, which applies to Ethereum.
How Wallet Delegation Expanded the Loss
EIP-7702 allows an ordinary Ethereum wallet, usually controlled directly by a private key, to temporarily run smart-contract code. This can support functions such as batching payments or paying transaction fees on a user’s behalf. In this incident, the feature let the attacker make a Binance wallet execute a contract that forwarded its assets.
The episode shows why the source of the authorization matters as much as the code being authorized. The contract could act through Binance 14 because the network received a valid signature, according to the transaction analysis. The permission also remained in effect until Binance recorded a revocation, while new customer deposits continued arriving. That combination helps explain how an initial transfer was followed by additional losses.
The reported $2.5 billion Ethereum component is not the full loss: Binance puts the broader, multi-chain figure at $6.3 billion. The distinction matters because EIP-7702 describes one route used in the theft, not a confirmed explanation for every stolen asset or blockchain transaction.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
EIP-7702 and Binance 14
EIP-7702 became active in May 2025 as part of Ethereum’s Pectra upgrade. It lets an ordinary wallet sign an authorization that points to smart-contract code; once accepted, the wallet can execute that code as though it were its own. The authorization remains active until another on-chain action replaces or cancels it.
The feature was designed to enable more flexible wallet functions. But the report notes that, within weeks of its launch, market maker Wintermute found many delegations pointed to copied “sweeper” scripts. Such scripts can automatically move a wallet’s funds to another address after its key or authorization has been compromised. In Thursday’s incident, the attacker used a sweeper contract to move funds from a major exchange wallet.
CoinDesk’s reconstruction says the attacker’s main wallet received small withdrawals through Tornado Cash beginning Wednesday, then tested the operation on wallets it controlled. It deployed the sweeper contract before submitting the bundle of 50 Binance 14 authorizations. That trail describes preparation visible on-chain; it does not establish how the attacker acquired the signatures from Binance.
How the Signatures Were Obtained
The blockchain records show that the transfers carried valid signatures associated with Binance-controlled wallets, but they do not establish who produced those signatures or how the attacker gained the ability to obtain them. Binance’s reference to a possibly compromised DevOps engineer’s laptop is described as a preliminary finding, not a confirmed account of the breach.
The report also does not provide a complete breakdown of the $6.3 billion figure by blockchain or asset, nor does it describe the full process or timing for reimbursing affected customers. The EIP-7702 analysis accounts for a major Ethereum portion of the incident, but the method behind transfers on other networks remains a separate investigative question.
Investigators will need to determine how the attacker obtained valid permissions across Binance-controlled wallets and whether the suspected access to internal systems played a role. Further findings could clarify whether the laptop or service-container scenario was involved, how the Ethereum signatures were generated and how the other blockchain transfers were authorized.
Binance has said it will cover the reported losses. The report does not state when a full investigation, final loss accounting or customer reimbursement details will be released. For now, the confirmed on-chain sequence establishes how the EIP-7702 delegation was used on Ethereum, while the wider security breach and its full mechanics remain under examination.
Key Questions
What did EIP-7702 do in the Binance theft?
EIP-7702 let Binance 14 run code from an attacker-controlled contract after the wallet’s signed authorization was accepted on Ethereum. The contract then moved ether and tokens out of the wallet.
How much was taken from the Ethereum wallet?
CoinDesk’s reconstruction puts the initial Ethereum transfer at about $2.5 billion in ether and tokens, including roughly $1.6 billion in USDT. Binance says the total loss across several blockchains was $6.3 billion.
How long did the malicious permission remain active?
The delegation remained active for nearly four hours. Binance 14 revoked it at 00:10:35 UTC Friday, according to the reported transaction timeline.
Is it known how the attacker got Binance’s signatures?
No. The transfers used valid signatures, but how the attacker obtained authority to produce them remains under investigation. Binance co-CEO Richard Teng cited a compromised DevOps engineer’s laptop as a preliminary possibility, not a confirmed conclusion.
Did EIP-7702 account for the entire $6.3 billion loss?
No. The report ties EIP-7702 to the Ethereum wallet theft. It says funds were also moved on Bitcoin, XRP, Solana, Tron and other networks, whose transfers did not use EIP-7702.
Source: coindesk.com
