The largest theft in the history of digital assets did not involve a direct leak of private keys. Instead, the $6.3 billion breach at Binance on Thursday relied on a compromise of the infrastructure used to sign transactions. While the attack spanned ten different blockchains, the Ethereum portion of the theft highlighted a specific vulnerability in a recent network upgrade. Attackers used Ethereum Improvement Proposal 7702 (EIP-7702) to turn a major Binance hot wallet into a "sweeper" that bypassed internal withdrawal safeguards.
EIP-7702 was implemented in May 2025 as part of the Pectra upgrade. It was designed to give ordinary wallets the capabilities of smart contracts, such as bundling multiple transactions or allowing a third party to pay gas fees. To use it, a wallet signs an authorization that delegates its authority to a specific piece of smart contract code. Once that message is on the network, the wallet follows the rules of that contract until the delegation is revoked or replaced.
The mechanics of the sweep
The attacker, using the wallet address 0x7C86…5CA0, began preparing for the exploit at least 36 hours before the main event. Funding came through small withdrawals from Tornado Cash starting Wednesday. On Thursday afternoon, the attacker tested the logic on their own wallets before deploying a 130-line sweeper contract, 0x63e8…6fAe. This contract was programmed to follow instructions only from the attacker’s primary wallet.
At 20:20:59 UTC on Thursday, the attacker submitted a transaction containing 50 separate authorizations. Every one of these was signed by the wallet labeled "Binance 14." Because "Binance 14" is a high-volume hot wallet, its transaction counter, or nonce, changes every few seconds as it processes customer withdrawals. The attacker prepared 50 different versions of the permission, each tied to a consecutive nonce from 18,914,775 to 18,914,824. This ensured that even if the wallet was busy, one of the malicious authorizations would land on the network.
The network accepted authorization number 18,914,809. From that moment, "Binance 14" was effectively under the control of the attacker's code. Within four minutes, at 20:24:23 UTC, the attacker triggered the sweeper. In one transaction, 167,464 $ETH and 63 different tokens, including 1.6 billion $USDT, were moved to the attacker.
Bypassing the safeguards
Security experts point out that the funds could have been stolen through traditional signed transfers, but EIP-7702 changed the speed and nature of the exploit. Ido Ben-Natan, CEO of Blockaid, noted that the upgrade allowed the attacker to drain assets in a single sweep. More importantly, it likely allowed them to bypass the exchange’s internal approval controls. Because the wallet was now running its own code, it could ignore the usual checks that Binance’s signing infrastructure might apply to a standard withdrawal request.
The takeover was not a one-time event. For nearly four hours, the malicious delegation remained active. As Binance’s internal systems continued to route new customer deposits into "Binance 14," the attacker’s code automatically swept them out at 21:04 and 21:44 UTC. The attacker also used the borrowed authority of "Binance 14" to send commands to another account, "Hot Wallet 34," pulling out an additional 823 million $USDC.
Infrastructure and signing systems
The breach extended far beyond Ethereum. Attackers moved 18,270 $BTC, hundreds of millions of $XRP, and significant funds from $SOL and Tron. These networks do not have EIP-7702, meaning the attacker was able to produce valid signatures for ordinary transfers across multiple independent cryptographic systems. This suggests the root of the problem was not a specific blockchain feature, but the environment where Binance generates and approves signatures.
Binance co-CEO Richard Teng stated that the investigation initially focused on a compromised laptop belonging to a DevOps engineer. This may have allowed the attacker to access a service container. However, the exchange later confirmed that it had uncovered additional points of breach. Teng emphasized that the attack was complex and involved more than just a single employee's permissions. Investigators from Chainalysis and TRM Labs have linked the activity to the North Korean group TraderTraitor, the same entity blamed for the $1.5 billion Bybit hack in February 2025.
The race to freeze
As the theft unfolded, the attacker attempted to move funds into assets that could not be frozen by centralized issuers. They swapped $325 million in stablecoins for $ETH over a 20-minute window, often accepting losses as high as 26% against market prices to complete the trades quickly. In one instance, the attacker deposited $59.9 million in stolen USDT into Aave as collateral to borrow 19,762 ETH.
The industry response led to the freezing of approximately $3 billion in affected assets. Aave briefly suspended its V3 and V4 markets as a precaution but reopened them on Friday afternoon after confirming its smart contracts were not compromised. Binance has pledged to cover the total $6.3 billion loss using its own reserves. The exchange reported it already held $5 billion of the affected tokens and is acquiring the remaining $1.3 billion through market and over-the-counter channels.
The malicious delegation on "Binance 14" was finally revoked at 00:10:35 UTC on Friday. Binance has stated it aims to begin reopening withdrawals in stages on Sunday, Nov. 1, 2025.
Sources
- Cointelegraph, EIP-7702 didn’t cause Binance hack, but may have amplified losses, https://cointelegraph.com/news/binance-hack-security-ethereum-eip-7702-role
- CoinDesk, Here’s how one Ethereum permission let an attacker drain $2.5 billion from Binance, https://www.coindesk.com/tech/2026/10/30/here-s-how-one-ethereum-permission-let-an-attacker-drain-usd2-5-billion-from-binance
- The Block, Inside the largest crypto hack on record: How attackers breached Binance for $6.3 billion, https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225
- Cointelegraph, Recap: How Binance’s record $6.3B hack unfolded, https://cointelegraph.com/news/recap-binances-record-63b-hack-unfolded
Cover: Sergei Starostin, Pexels.
