Binance Hack Shows How One Ethereum Permission Drained $2.5 Billion
TL;DR
shows an attacker reportedly used Ethereum’s EIP-7702 authorization feature to drain approximately $2.5 billion from Binance’s Ethereum hot wallet.
The attacker gained the ability to move funds without repeatedly requesting individual transaction approvals. The incident forms part of a wider Binance security breach estimated at $6.3 billion.
Binance suffered one of the largest cryptocurrency security incidents on record after an attacker exploited an Ethereum authorization mechanism to drain approximately $2.5 billion from one of its hot wallets.
The attack targeted a wallet identified as Binance 14 and involved Ethereum’s EIP-7702 functionality, which allows externally owned accounts to temporarily execute smart contract code without migrating to a separate smart contract wallet.
the attacker used a malicious authorization to give a smart contract control over the wallet’s transaction execution. This effectively transformed the exchange’s wallet into an automated fund-draining mechanism.
The incident is part of a broader security breach that affected multiple Binance wallets across several blockchain networks, with estimated losses reaching approximately $6.3 billion.
How EIP-7702 Enabled the Binance Wallet Drain
EIP-7702 was introduced as part of Ethereum’s Pectra upgrade to improve wallet functionality and support features such as transaction batching and account abstraction.
However, the same flexibility can introduce serious security risks when authorization requests are not properly verified.
In Binance’s case, blockchain security analysts reported that the attacker prepared 50 EIP-7702 authorization requests targeting Binance 14. Each authorization was associated with a specific transaction nonce, meaning only one would match the wallet’s current transaction sequence. One of those authorizations was accepted, allowing the wallet to execute code from a malicious sweeper contract.
The binance hack shows the attacker subsequently called the contract to transfer assets out of the wallet. The first major transaction moved approximately 167,464 ETH, alongside roughly $1.6 billion in USDT and dozens of other tokens.
The combined value of the assets transferred was approximately $2.5 billion.
According to , the attacker continued using the delegated functionality to execute additional transfers over the following hours.
The Ethereum wallet incident was only one component of a much larger attack.
Binance estimated that approximately $6.3 billion in cryptocurrency was affected across multiple blockchain networks. Its preliminary investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have provided access to internal infrastructure and enabled unauthorized withdrawal requests.
The exchange said it had found no evidence that wallet private keys were leaked.
Meanwhile, blockchain security companies identified unusual authorization activity and suspicious transaction patterns across the affected wallets.
Binance also coordinated with stablecoin issuers and blockchain partners to freeze portions of the stolen assets. Approximately $3 billion had reportedly been frozen, although the recovery process remained ongoing.
Bitcoinist previously reported on the .
Ethereum’s Wallet Flexibility Raises New Security Questions
The incident highlights an important distinction between introducing more functionality into cryptocurrency wallets and maintaining secure authorization processes.
EIP-7702 offers legitimate benefits for Ethereum users, including more flexible transaction execution. However, delegating execution to external code also means that malicious permissions can create significant exposure if signing systems fail to identify suspicious requests.
The Binance incident does not establish that EIP-7702 itself contains a vulnerability. Instead, it demonstrates how a legitimate protocol feature can become part of an attack when authorization controls are compromised.
For the broader cryptocurrency industry, the incident adds urgency to discussions about transaction verification, wallet permissions, and operational security.
