Binance Attacker Used EIP-7702 to Bypass Wallet Controls, Teng Says

Binance disclosed that a coordinated attack on October 29, 2026 drained roughly $6.3 billion from its hot‑wallet infrastructure across multiple blockchains. The breach was traced to the exploitation of Ethereum’s EIP‑7702 delegation feature, which allowed the attacker to bypass the exchange’s normal approval controls. Co‑CEO Richard Teng said the loss was covered by company reserves and that user assets remained untouched. The investigation revealed several entry points, including a compromised DevOps engineer’s laptop, and indicated that multiple actors were involved.

Background

The Binance breach unfolded at a time when the exchange’s hot‑wallet system handled massive daily withdrawal volumes. Binance’s security model required multi‑layer approvals before any on‑chain transaction could be signed and broadcast. Ethereum’s EIP‑7702, introduced to enable wallet owners to delegate transaction execution to smart contracts, had previously been cited in smaller incidents, such as an October 14 attack that lost about $22,770. In the current case, Blockaid identified 50 EIP‑7702 authorizations submitted in a single transaction, with only one matching the hot‑wallet’s nonce and successfully redirecting the wallet to a malicious contract. The attacker’s contract executed a sweep function that moved ETH and ERC‑20 tokens while retaining a small amount for gas. Binance’s initial response linked the breach to a compromised DevOps engineer’s laptop, which may have given the attacker access to an internal service container used for withdrawals. Subsequent analysis uncovered additional breach points beyond the laptop, suggesting a complex, multi‑stage operation. The incident prompted a coordinated industry response, with stablecoin issuers such as Tether and Circle freezing billions of dollars in linked assets, and blockchain intelligence firms noting similarities to prior North Korean‑linked hacks.

What happened

On the evening of October 29, 2026, an attacker submitted a transaction containing 50 EIP‑7702 authorizations targeting Binance’s hot wallet known as Binance 14, as reported by Blockaid (source 4). Only one authorization matched the wallet’s current nonce, allowing the delegation to a malicious contract that executed a sweep function and transferred assets to attacker‑controlled addresses (source 4). Binance’s investigation later identified a compromised DevOps engineer’s laptop as an initial entry point, giving the attacker access to a service container that could submit withdrawal requests (source 3). Further investigation revealed additional breach points beyond the laptop, indicating a more complex attack involving multiple actors (source 1, source 3). The attacker used a self‑destruct mechanism to erase tooling and traces after the theft (source 2). The theft spanned roughly 20 minutes and affected about ten blockchains, moving assets worth an estimated $6.3 billion (source 3). Approximately $3 billion of the stolen assets have been frozen on‑chain, while Binance reserved more than $6.34 billion in company funds to cover the losses, stating that user funds were not used (source 2, source 3). Binance paused withdrawals and deposits while it rebuilt and retested its infrastructure, targeting a restoration window of roughly 40 to 48 hours (source 2, source 3). The exchange also announced plans to publish a proof‑of‑reserves report by the following Monday for independent verification (source 2). Industry partners, including Tether, Circle, Ripple, and World Liberty Financial, froze roughly $3 billion in related stablecoins, further containing the fallout (source 2). Blockchain analytics firms linked the attack to North Korea’s TraderTraitor group, though Binance and governments have not formally confirmed attribution (source 3, source 4).

Market impact

The hack resulted in an estimated $6.3 billion loss from Binance’s hot wallets, making it the largest crypto heist on record. About $3 billion of the stolen assets have been frozen on‑chain, while Binance reserved roughly $6.34 billion in company funds, with about $5 billion already held in USDC, USDT, Bitcoin, Ethereum and BNB (source 2). Industry participants froze roughly $3 billion in stablecoins: Tether froze more than $1.57 billion, Circle over $800 million, Ripple about $200 million, and World Liberty Financial about $27 million in stablecoins plus $2 million in its own token (source 2). The withdrawal pause lasted until the exchange could rebuild its controls, with a target resumption window of 40 to 48 hours. Binance’s plan to buy the remaining reserve amount through market and OTC channels could affect liquidity, especially given thin market depth and settlement delays noted by the exchange (source 2). The coordinated freezes and the upcoming proof‑of‑reserves publication aim to reassure users and stabilize market confidence after the shock.

Why it matters

The breach highlights a critical vulnerability in the use of EIP‑7702 delegation, showing how a single successful authorization can override multi‑signature safeguards on high‑value hot wallets. Binance’s reliance on a compromised engineer’s laptop underscores the importance of endpoint security and zero‑trust architectures for exchange operations. The industry‑wide freezing of stablecoins demonstrates rapid collective action to contain illicit flows, but also reveals systemic exposure to large‑scale thefts. Binance’s commitment to cover losses from its own balance sheet, rather than tapping user funds, may set a precedent for exchange liability and could influence future SAFU fund policies. The attribution hints toward state‑backed actors, raising geopolitical concerns about the use of blockchain for illicit financing. Finally, the planned proof‑of‑reserves report could become a new benchmark for transparency, potentially reshaping how exchanges demonstrate solvency after major incidents.