EIP-7702 didn’t cause Binance hack, but may have amplified losses

On Thursday, October 30, 2026, Binance suffered a breach that saw roughly $6.3‑$6.4 billion siphoned from its hot wallets across about ten blockchains. The attack was linked by blockchain‑analytics firms to the North Korean‑linked group TraderTraitor. Binance said the loss stemmed from a compromised signing system rather than a private‑key leak, and the exchange pledged to cover the entire amount with company funds and its emergency reserve.

Background

Ethereum’s Pectra upgrade in May 2025 introduced EIP‑7702, a feature that lets ordinary wallets temporarily execute smart‑contract code, enabling bundled transactions and sponsored gas fees. Within weeks, security researchers flagged the new delegation mechanism as a potential vector for malicious contracts that could automatically drain wallets. Wintermute reported that many early delegations pointed to such contracts, and later, holders of World Liberty Financial tokens experienced losses tied to malicious EIP‑7702 delegations. Community member VEER highlighted these warnings during 2024 discussions and later described EIP‑7702 as a “handy sweep button” that could simplify large‑scale drains. Binance’s own investigation initially blamed a compromised laptop belonging to a DevOps engineer, but later uncovered additional breach points, suggesting a more complex attack that involved the exchange’s signing infrastructure. The exchange’s CEO Richard Teng emphasized that no private‑key leakage was detected, and the signer ultimately approved a transaction it should not have. Blockchain security firm Blockaid’s co‑founder Ido Ben‑Natan explained that while the attackers could have drained the funds without EIP‑7702, the upgrade allowed them to do so in a single sweep, potentially bypassing multiple checks. Ambire’s CEO Ivo Georgiev warned that exchange engineers might overlook revoking malicious delegations after regaining control, noting the feature’s poor understanding among developers.

What happened

According to Cointelegraph, Blockaid’s Ido Ben‑Natan told the outlet that attackers could have stolen Binance’s assets without EIP‑7702, but the upgrade let them execute the drain in one transaction, possibly bypassing standard safeguards. Binance confirmed the $6.3 billion hack on Friday and said it had initially suspected a compromised engineer’s laptop before uncovering further breach points, as reported by both Cointelegraph and TradingView. The exchange’s CEO Richard Teng stated investigators found no evidence of private‑key leakage, indicating the breach stemmed from a signing‑system compromise. TRM Labs and Chainalysis, cited by Decrypt, attributed the attack to the North Korean‑linked group TraderTraitor, noting the thieves moved funds across roughly ten blockchains within about twenty minutes after the breach began at 4:05 p.m. ET. The attackers used fifty pre‑signed authorizations under EIP‑7702 to turn a Binance hot wallet into a “sweeper” contract, draining assets in a single sweep, according to TRM Labs. Binance later announced it had set aside more than $6.34 billion to cover the loss, with about $5 billion already held in the exact tokens stolen, as detailed by LCX and Decrypt. The exchange said the remaining funds would be purchased on open and over‑the‑counter markets, and that it would publish a proof‑of‑reserves report after the incident. Stablecoin issuers quickly froze roughly $3 billion of the stolen assets, and Binance paused withdrawals while it rebuilt its systems.

Market impact

The hack removed roughly $6.3‑$6.4 billion from Binance’s hot wallets, a figure that dwarfs the previous record of $1.5 billion from the February 2025 Bybit heist. TRM Labs reported that about 84 % of the stolen Ethereum was converted into Bitcoin via Thorchain. Binance’s emergency reserve, known as the Secure Asset Fund for Users, together with the $5 billion of matching tokens, totals more than $6.34 billion earmarked for restitution. CertiK estimated that Binance’s $1.17 billion emergency fund and $3 billion of frozen assets could cover roughly 66 % of the loss, leaving a potential $2.1 billion gap, which represents about 1.3 % of Binance’s reported $165 billion in exchange reserves. Nansen could not verify Binance’s holdings beyond its $1.16 billion emergency fund, while Binance’s founder Changpeng Zhao cited SpaceX holdings worth over $1 billion as additional backing. The incident triggered a cross‑border law‑enforcement investigation and prompted stablecoin issuers to freeze assets, highlighting the systemic risk of large‑scale exchange breaches.

Why it matters

The breach underscores the vulnerability of centralized exchanges’ signing infrastructure, showing that compromising a developer’s workstation can cascade into a multi‑billion‑dollar loss. It also illustrates how new blockchain features like EIP‑7702 can be weaponized, even if they do not introduce a protocol flaw, by giving attackers a streamlined method to execute large sweeps. The attribution to a North Korean state‑linked group raises geopolitical concerns, as the theft adds significantly to the regime’s crypto revenue stream. Binance’s pledge to cover all losses with company funds and its emergency reserve tests the resilience of exchange balance sheets and may set a precedent for future incidents. The rapid freezing of stablecoins and the involvement of cross‑chain bridges such as Thorchain highlight the interconnectedness of the crypto ecosystem and the need for coordinated response mechanisms. Finally, the episode may prompt regulators and developers to re‑examine delegation mechanisms and signing‑process safeguards to prevent similar exploits.