Binance Suffers $2.5 Billion Hack via EIP-7702 Delegation Exploit
Attackers exploited smart contract delegation to drain assets from Binance hot wallets.
1The Massive Security Breach
On October 29, 2026, Binance experienced the largest hack in crypto history. Attackers drained approximately $2.5 billion from a single hot wallet, Binance 14, using 50 EIP-7702 delegation authorizations. Within 12 minutes, ten additional hot wallets across four different blockchains were compromised, marking a highly coordinated and sophisticated multi-chain financial attack.
2Exploiting EIP-7702 Delegation
The attacker leveraged EIP-7702, which allows standard Ethereum wallets to delegate operations to smart contract code. By preparing a range of authorizations corresponding to different nonce values, the hacker ensured one would succeed. Once the delegation was active, the wallet executed the attacker's sweep function, moving assets to an unauthorized address.
3Preparation and Testing Phase
Blockaid analysis reveals the attacker prepared for at least one day before the main theft. The operator address was funded via three Tornado Cash transactions. The hacker tested the delegation and asset movement mechanism on three private wallets, ensuring the sweep function could successfully transfer Ethereum and various tokens before targeting Binance.
4Execution and Asset Drain
The breach began when the attacker triggered a sweep function on Binance 14, removing 167,464 ETH and 1.615 billion USDT. Shortly after, Binance 16 transferred additional assets to the same address. The attacker maintained control because the delegation remained active, allowing repeated withdrawals without needing new signatures for every subsequent transaction performed.
5Detection and Response Time
Blockaid systems detected the initial large-scale transfer just 1 minute and 55 seconds after it occurred. Their tools identified the delegation mechanism and unauthorized signing patterns within 11 minutes. Despite this rapid detection, the attacker had already successfully moved significant portions of the stolen assets to new addresses and decentralized exchanges.
6Asset Freeze and Recovery
Tether and Circle responded by freezing approximately $1.8 billion on the primary collection address. However, native assets like Ethereum lack a central issuer, making them impossible to block at the contract level. Consequently, Binance has reserved over $6.3 billion to cover the total losses incurred during this unprecedented security incident.
7The Unknown Compromise Vector
While the technical mechanism of the drain is clear, the initial entry point remains unknown. Investigators have not yet determined how the attacker obtained the specific authorizations signed for the exchange's wallets. This missing link in the security chain is critical for understanding how such high-level infrastructure was successfully bypassed by hackers.
8Future Security Implications
This incident demonstrates that monitoring standard transfers is insufficient for modern exchange security. Blockaid emphasizes that delegation mechanisms like EIP-7702 require rigorous pre-signature validation. Exchanges must implement stricter policies to verify transaction logic before signing, as attackers are increasingly targeting the complex code interactions inherent in modern blockchain account abstraction standards.
Original article: INCRYPTED — Binance Suffers $2.5 Billion Hack via EIP-7702 Delegation Exploit