CoinDesk
An attacker used Ethereum’s EIP-7702 feature to drain about $2.5 billion in ether and tokens from a Binance wallet in less than four minutes. Binance puts the broader theft across several blockchains at $6.3 billion and says it will cover the losses.
The attacker’s transaction carried 50 authorizations signed by Binance wallet Binance 14, each pointing to malicious code. The network accepted one authorization, allowing a sweeper contract controlled by the attacker to move about 167,464 ETH and 63 tokens, including roughly $1.6 billion in USDT. Further deposits arriving at the wallet were swept out as well. Binance 14 remained under the malicious delegation for nearly four hours, until the permission was revoked.
Why it matters
EIP-7702, introduced with Ethereum’s Pectra upgrade in May 2025, lets an ordinary wallet run smart-contract code after signing an authorization. The feature can support functions such as batched payments and fee sponsorship, but an authorization can also delegate control without specifying a payment recipient or spending limit. If the code is malicious, funds already in the wallet and deposits arriving later can be exposed.
The incident highlights that a valid signature does not by itself mean a transfer is safe. The central unanswered question is how the attacker obtained Binance’s authorizations. Binance co-CEO Richard Teng said preliminary findings pointed to a compromised DevOps engineer’s laptop, while cautioning that the attack was more complex than a single person’s permissions or a one-click action. Binance later said investigators found additional breach points.
Market impact
EIP-7702 explains the Ethereum portion, not the full theft. Binance-linked wallets also sent funds on networks including Bitcoin, XRP, Solana and Tron through ordinary signed transfers. The common thread, investigators say, is that the transfers carried valid signatures from Binance-controlled wallets.
Binance has pledged to cover the $6.3 billion in losses with its SAFU emergency fund and company funds. It said about $3 billion of affected assets had been frozen.
Frequently asked questions
-
How did EIP-7702 feature in the Binance wallet theft?
EIP-7702 let Binance wallet Binance 14 run attacker-controlled smart-contract code after accepting a signed authorization. The attacker used that code to sweep funds.
-
How much was drained from the Binance Ethereum wallet?
About $2.5 billion in ether and tokens was drained from a Binance wallet in less than four minutes. The Ethereum theft was part of a wider cross-chain loss Binance estimated at $6.3 billion.
-
Why could the attacker take funds deposited after the initial drain?
The malicious delegation remained active for nearly four hours. Binance deposits continued arriving at the affected wallet, and the attacker swept out further funds before the permission was revoked.
-
What does an EIP-7702 authorization allow a wallet to do?
It allows an ordinary Ethereum wallet to run smart-contract code. The authorization does not specify a payment recipient or spending amount, so malicious code can expose existing funds and later deposits.
-
How much of the affected assets did Binance say had been frozen?
Binance said about $3 billion of affected assets had been frozen. The exchange pledged to cover the losses using its SAFU emergency fund and company funds.
WatcherGuru
WuBlockchain
TheBlock
CryptoSlate