AnswersPublished20 sources
How EIP-7702 Enabled a $2.5 Billion Binance Hot-Wallet Drain
On October 29, 2026, attackers used an EIP 7702 authorization to drain about $2.5 billion from Binance’s Binance 14 wallet in one transaction. The sweep followed a compromise of Binance’s internal systems and came about three minutes after the authorization.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- On October 29, 2026, attackers used an EIP 7702 authorization to drain about $2.5 billion from Binance’s Binance 14 wallet in one transaction.
- The sweep followed a compromise of Binance’s internal systems and came about three minutes after the authorization.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: How did the reported October 29 Binance hack unfold—from fake job postings that tricked an engineer into downloading malware to attackers us. Article summary: The available reporting describes a compromise of Binance’s internal systems followed by abuse of Ethereum’s EIP-7702 wallet delegation—not a $15 purchase of access to billions of dollars. The reported $15 was the networ. Topic tags: general, government, general web, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with
The reported $15 fee was not what gave attackers access to Binance. Reporting says they had already compromised internal systems and obtained a valid authorization for the exchange’s Binance 14 hot wallet. They then used Ethereum’s EIP-7702 delegation mechanism to let attacker-controlled code execute through that wallet, setting up a roughly $2.5 billion sweep. 18
22
The reported attack sequence
Binance’s November 3 incident account described a social-engineering campaign in which attackers used a fake job interview and malicious software to compromise an engineer’s computer. Reporting based on the exchange’s account says attackers then abused an internal AI tool to reach systems involved in wallet signing.
The on-chain sequence followed on October 29:
- 20:20:59 UTC: A transaction carried 50 EIP-7702 authorizations signed with the Binance 14 wallet’s key, according to blockchain analysis cited in reporting.
18
24
- 20:24:23 UTC: About three minutes and 24 seconds later, a transaction swept approximately $2.5 billion from Binance 14. The reported assets included about 167,464 ETH and roughly $1.615 billion in USDT, alongside other tokens.
17
That single transfer was reported as roughly 40% of the wider theft. The broader incident was estimated at about $6.3–$6.4 billion across multiple chains, rather than just the Binance 14 Ethereum transaction. 9
22
What EIP-7702 did—and what the $15 paid for
EIP-7702 lets a regular Ethereum account delegate some of its behavior to a smart contract. In the reported Binance incident, an authorization linked Binance 14 to attacker-controlled code that could execute a sweeping operation. 13
24
The approximately $15 figure refers to network fees for putting the authorization on-chain. It does not represent the cost of compromising an engineer’s computer, accessing Binance’s signing infrastructure, or obtaining the valid authorization. 22
The distinction matters: a valid on-chain authorization is not, by itself, proof that an attacker obtained or exposed the wallet’s private key. Binance described unauthorized access to an internal wallet-signing service, while Fireblocks’ preliminary analysis reported no evidence that private keys had leaked. 8
21
The wider theft and Binance’s response
TRM Labs estimated that approximately $6.36 billion left Binance wallets across ten blockchains, mostly within about 20 minutes beginning at 20:05 UTC. Binance’s own initial findings put the impact at approximately $6.34 billion. These are estimates of the wider multichain incident, not the value of the Binance 14 sweep alone. 8
9
Binance said about $2.85 billion had been frozen or intercepted at the time of its initial update, subject to reconciliation and changes in market prices. That figure describes assets contained or intercepted; it should not be treated as the amount recovered and returned. 8
The exchange also paused withdrawals during its response, then began reopening them in phases, according to contemporaneous reporting. Reporting separately says the affected on-chain authorization was revoked. Those steps address different parts of the incident: pausing exchange withdrawals and revoking a wallet authorization are not the same action. 11
The FBI later attributed the theft of more than $6 billion to North Korea and named the activity TraderTraitor. That attribution concerns the broader incident; the transaction timeline explains how the Ethereum wallet drain was carried out, not who carried it out. 1
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How EIP-7702 Enabled a $2.5 Billion Binance Hot-Wallet Drain"?
On October 29, 2026, attackers used an EIP 7702 authorization to drain about $2.5 billion from Binance’s Binance 14 wallet in one transaction.
What are the key points to validate first?
On October 29, 2026, attackers used an EIP 7702 authorization to drain about $2.5 billion from Binance’s Binance 14 wallet in one transaction. The sweep followed a compromise of Binance’s internal systems and came about three minutes after the authorization.
Sources
theedgemalaysia.comHackers paid US$15 to drain US$2.5 billion from Binance in one hit