Ethereum EIP-7702 was leveraged by hackers to steal an estimated $6.3 billion from Binance’s hot wallets on October 29, 2026. 3 billion theft from its hot wallets on Thursday, October 29, 2026. The monumental breach, which impacted assets across at least ten different blockchains, leveraged a recently implemented Ethereum upgrade known as Ethereum EIP-7702 to drain a significant portion of the funds from Binance.
Investigators are still piecing together the full attack path, but blockchain analytics firms attribute the incident with high confidence to the North Korean hacking group TraderTraitor. This event marks potentially the largest cryptocurrency theft in history, raising urgent questions about network security and the implications of new blockchain functionalities.
Ethereum EIP-7702 Binance: a double-edged sword
EIP-7702, or Ethereum Improvement Proposal 7702, went live in May 2025 as part of the extensive Pectra upgrade. This feature was designed to bring smart contract-like capabilities to ordinary Ethereum wallets, known as Externally Owned Accounts (EOAs). Its primary goal was to enhance user experience.
It allows EOAs to temporarily run smart contract code, enabling functions such as batch payments and gas fee sponsorship by third parties. Authors like Ethereum co-founder Vitalik Buterin envisioned a future with more flexible and user-friendly wallet interactions, but the recent exploit exposed a critical vulnerability.
Ordinary wallets versus smart contracts
Typically, an ordinary Ethereum wallet operates through a private key, which signs transactions before they’re sent. These wallets are straightforward; they cannot execute complex rules like daily spending limits or pre-approved recipient lists. Smart contracts, on the other hand, are distinct accounts capable of running sophisticated code and enforcing predefined conditions.
EIP-7702 bridges this gap. It permits an EOA to sign an authorization that points to a specific smart contract. Once this authorization is accepted by the network, the EOA effectively “borrows” that contract’s code and executes it as if it were natively built into the wallet. This delegation remains active until a new authorization or cancellation is recorded on-chain.
The delegation mechanism and its risks
The authorization process allows anyone to submit the signed message to the network. This mechanism was intended to streamline operations, letting everyday users manage their digital assets more efficiently. But as the Binance hack demonstrated, the same flexibility also introduces considerable risks when malicious actors gain access.
Just weeks after the Pectra upgrade, market maker Wintermute warned about malicious Ethereum contracts. They found a majority of EIP-7702 delegations were routing through “sweeper” scripts. These scripts are designed to automatically drain funds from compromised EOAs, a precursor to the method used in the Binance breach.
Exploiting the EIP-7702 delegation on Binance
The attackers specifically targeted a Binance wallet labeled “Binance 14.” They used EIP-7702 to force this wallet, which held billions in digital assets, to execute their own custom-designed sweeper script. The attack unfolded rapidly on Thursday, October 29, 2026.
Approximately $2.5 billion in Ether and various tokens were siphoned off within just four minutes. This single Ethereum-based component of the broader attack highlights the immediate and devastating impact a compromised EIP-7702 delegation can have on a high-value target.
The nonce manipulation strategy
To execute the Ethereum-specific drain, the attacker deployed a sweeper contract earlier on Thursday. At 20:20:59 UTC, they sent a transaction containing 50 authorizations, each signed by Binance 14 and directing it to the malicious sweeper. Each signed authorization is tied to a specific “nonce,” a counter that advances with every transaction a wallet sends.
Binance 14 was processing numerous withdrawals, causing its nonce to change constantly. The attacker meticulously prepared 50 permissions covering consecutive nonce numbers, from 18,914,775 to 18,914,824. This strategy ensured that one of the malicious authorizations would align with the wallet’s current nonce when the network processed it, despite the high transaction volume.
Sweeper scripts and ongoing theft
Etherscan data analyzed by CoinDesk confirmed that the network accepted the authorization corresponding to nonce 18,914,809. At 20:24:23 UTC, the attacker invoked the sweeper through Binance 14, moving about 167,464 ETH and 63 tokens, including roughly 1.6 billion USDT. But the theft didn’t stop there.
Binance’s internal systems continued routing customer deposits into the now-compromised Binance 14 wallet. The attacker repeatedly swept these incoming funds at 21:04 UTC and 21:44 UTC. The malicious delegation persisted for nearly four hours before Binance 14 finally revoked the permission at 00:10:35 UTC on Friday, October 30, 2026, clearing the attacker’s code.
Tracing the multi-blockchain theft and attacker’s access
The Ethereum portion of the attack, while significant, was only one piece of a much larger puzzle. The total estimated loss across all affected blockchains reached approximately $6.3 billion. Funds were stolen from Binance wallets across multiple networks, including Bitcoin, Tron, Solana, Arbitrum, and Avalanche.
Blockchain analytics firm TRM Labs reported that the attacker also pulled 823 million USDC from a separate Binance smart wallet, Hot Wallet 34, using Binance 14’s borrowed code. This broader scope indicates a sophisticated and multi-pronged attack beyond just the EIP-7702 exploit.
Broader implications beyond Ethereum
Unlike the Ethereum-based theft, funds on other blockchains were moved via ordinary signed transfers, not EIP-7702. This distinction is crucial; it suggests the attackers obtained valid signatures from Binance-controlled wallets across various platforms. The common thread points to a fundamental compromise of Binance’s signing infrastructure rather than a single EIP-7702-specific flaw.
The attacker’s main wallet, 0x7C86…5CA0, was initially funded through the mixing service Tornado Cash in small withdrawals. This technique is often used to obscure the origin of illicit funds. The coordinated nature of the theft across disparate blockchain ecosystems underscores the advanced capabilities of the perpetrators.
Initial findings on attack vector
Binance co-CEO Richard Teng stated that preliminary findings pointed to a compromised DevOps engineer’s laptop. This access may have allowed the attacker to infiltrate a service container and submit unauthorized withdrawal orders. However, Mr. Teng quickly clarified that it was a complex process, not a simple “one-click” action.
Binance found no evidence of a direct private key leak, suggesting the attackers exploited internal systems to generate valid signatures. The exchange later confirmed additional breach points beyond the laptop, but has yet to publicly detail how the attackers managed to obtain such widespread authorization across its wallets.
Binance’s swift response and recovery efforts
In the wake of the massive breach, Binance acted quickly to mitigate further damage and begin recovery. The exchange temporarily suspended all deposits and withdrawals to prevent additional losses and revoke authorizations for affected addresses. This immediate response was critical to stabilizing the situation.
Binance’s founder, Changpeng Zhao, publicly acknowledged the incident as a “hack” on X just hours after the attack began. He assured stakeholders that all losses would be covered, emphasizing the exchange’s commitment to its users.
Fund coverage and frozen assets
Binance has pledged to cover all losses using its SAFU emergency fund and its own company funds, allocating $6.34 billion for this purpose. The exchange already holds about $5 billion of the committed funds in the same digital assets that were affected. They are actively acquiring the remaining $1.3 billion through market and over-the-counter channels.
Significant recovery efforts are already underway. Roughly $3 billion of the stolen assets have been frozen with the help of partners. Tether CEO Paolo Ardoino confirmed freezing over $1.57 billion in USDT, while Circle secured more than $800 million in USDC.
Binance co-CEO Yi He also reported that Ripple “promptly” froze approximately $200 million in associated RLUSD. These stablecoin freezes represent about 43% of the total haul, demonstrating the power of centralized stablecoin issuers in such situations.
Market repercussions following the exploit
The sheer scale of the Binance hack sent ripples through the crypto markets. Bitcoin saw its price fall below $77,000, while Ethereum dropped to around $2,200. BNB, Binance’s native token, also experienced a significant decline, falling below $700. The market instability led to the liquidation of approximately $1.5 billion in leveraged positions, indicating a broader loss of investor confidence in the immediate aftermath.
Such large-scale events can heavily influence bitcoin ethereum price outlooks. The incident serves as a stark reminder of the volatility inherent in the crypto space and the constant threat posed by sophisticated cyberattacks. As exchanges continue to evolve, the need for robust security measures becomes ever more paramount.
Prior warnings and the evolving threat landscape
The exploitation of EIP-7702, though unprecedented in scale, was not entirely unforeseen. Security researchers had previously highlighted the potential risks associated with the feature. Warnings had surfaced concerning the ease with which delegated permissions could be abused if an EOA was compromised, even without a direct private key leak.
In July 2025, blockchain security firm SlowMist reported that the Ethereum ecosystem was the most affected by security incidents. The EIP-7702 wallet delegation feature was specifically identified as an emerging risk. This prior insight underscores a critical challenge for the crypto industry: balancing innovation with ironclad security.
Wintermute’s early observations on sweeper scripts
Just weeks after EIP-7702’s launch in May 2025, crypto trading firm Wintermute published a stark warning. They observed that over 90% of EIP-7702 delegations were being directed to malicious “sweeper” scripts. These scripts, often labeled “CrimeEnjoyor,” are designed to automatically drain funds from compromised wallets. Wintermute cautioned that while EIP-7702 didn’t cause private key compromise, it significantly accelerated fund draining once a key was exposed.
This early red flag from a prominent market maker provided clear indications of the feature’s potential for abuse. The Binance incident serves as a painful validation of those warnings, showcasing how quickly such theoretical vulnerabilities can manifest into real-world, multi-billion-dollar losses.
The ongoing challenge for exchanges and users
The Binance hack underscores the persistent and evolving threat landscape facing cryptocurrency exchanges. While Binance’s initial investigation points to a compromised laptop rather than a direct private key breach, the incident highlights the complex nature of securing vast digital asset holdings. It also reinforces the critical need for continuous vigilance against sophisticated cyberattacks.
For users, the event is a potent reminder of the importance of robust personal security practices and understanding the underlying mechanisms of the platforms they use. The speed and scale of the attack demonstrate that even advanced blockchain features, designed for convenience and efficiency, can be weaponized in the wrong hands, creating a challenging environment for both innovators and investors.