TL;DR
- Binance 14 was delegated to attacker-controlled code through EIP-7702, enabling one transaction to sweep about $2.5 billion in ETH and tokens.
- The attacker used 50 valid authorizations covering consecutive nonces. EIP-7702 required Binance 14 signatures, leaving the source of those signatures central to the investigation.
- Researchers say EIP-7702 may have amplified the drain but did not cause the broader breach, which affected multiple chains and used ordinary signed transfers elsewhere.
A 2025 Ethereum feature was used to turn a Binance hot wallet into an attacker-controlled smart-account sweeper, enabling a single transaction to move about $2.5 billion in ETH and tokens. An onchain reconstruction shows the attacker installed an EIP-7702 delegation on Binance 14 using valid signed authorizations. The episode affects Ethereum account security, but the available evidence does not show a vulnerability in Ethereum itself.
EIP-7702 Amplified the Binance Drain but Did Not Cause the Initial Breach
EIP-7702, activated through Pectra in May 2025, allows an externally owned account to temporarily execute smart-contract code after signing an authorization. The mechanism requires valid authorization from the account being delegated, which is why the central unanswered question is how the attacker obtained Binance 14 signatures. The incident illustrates the security implications of the smart-wallet capabilities introduced with Pectra without establishing that EIP-7702 created the initial compromise.
At 20:20:59 UTC, the attacker submitted a type-4 transaction containing 50 authorizations signed for consecutive Binance 14 nonces. One matched the live nonce, causing the wallet to point to the attacker’s contract. About three minutes later, a sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT, in one transaction. The attacker address had previously received gas funding and deployed the malicious contract.
The Ethereum technique represented only part of the wider incident. EIP-7702 was used against Binance 14, while other affected wallets signed ordinary outgoing transfers, including activity across Bitcoin, Tron and additional networks. Binance’s preliminary investigation said a compromised DevOps engineer laptop may have provided access to a service container, while finding no evidence of a private-key leak. The exchange also paused withdrawals during security checks.
Security researchers therefore distinguish between the breach path and the Ethereum execution mechanism. EIP-7702 may have amplified the damage by allowing many assets to be swept atomically, but valid signatures were still necessary, and attackers with signing access could potentially move funds through other transaction types. Binance placed the broader impact near $6.3 billion, with roughly $3 billion frozen. The stablecoin freezes used during the response further show how asset controls differed once funds had left the exchange. The distinction matters because EIP-7702 changed what a signed Ethereum account could execute, not who could authorize it. Investigators are therefore focusing on Binance’s signing environment and access controls as they reconstruct the sequence that produced those signatures.
