# Binance Suffers $2.5 Billion Hack via EIP-7702 Delegation Exploit Attackers exploited smart contract delegation to drain assets from Binance hot wallets. - **Source:** [INCRYPTED](https://brifing.si/source/7cd4625d-3f08-4cc1-983d-4c7d991839ba) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/137caa8c-2e89-40a5-aeee-adc8b422ca34 ## The Massive Security Breach On October 29, 2026, Binance experienced the largest hack in crypto history. Attackers drained approximately $2.5 billion from a single hot wallet, Binance 14, using 50 EIP-7702 delegation authorizations. Within 12 minutes, ten additional hot wallets across four different blockchains were compromised, marking a highly coordinated and sophisticated multi-chain financial attack. ## Exploiting EIP-7702 Delegation The attacker leveraged EIP-7702, which allows standard Ethereum wallets to delegate operations to smart contract code. By preparing a range of authorizations corresponding to different nonce values, the hacker ensured one would succeed. Once the delegation was active, the wallet executed the attacker's sweep function, moving assets to an unauthorized address. ## Preparation and Testing Phase Blockaid analysis reveals the attacker prepared for at least one day before the main theft. The operator address was funded via three Tornado Cash transactions. The hacker tested the delegation and asset movement mechanism on three private wallets, ensuring the sweep function could successfully transfer Ethereum and various tokens before targeting Binance. ## Execution and Asset Drain The breach began when the attacker triggered a sweep function on Binance 14, removing 167,464 ETH and 1.615 billion USDT. Shortly after, Binance 16 transferred additional assets to the same address. The attacker maintained control because the delegation remained active, allowing repeated withdrawals without needing new signatures for every subsequent transaction performed. ## Detection and Response Time Blockaid systems detected the initial large-scale transfer just 1 minute and 55 seconds after it occurred. Their tools identified the delegation mechanism and unauthorized signing patterns within 11 minutes. Despite this rapid detection, the attacker had already successfully moved significant portions of the stolen assets to new addresses and decentralized exchanges. ## Asset Freeze and Recovery Tether and Circle responded by freezing approximately $1.8 billion on the primary collection address. However, native assets like Ethereum lack a central issuer, making them impossible to block at the contract level. Consequently, Binance has reserved over $6.3 billion to cover the total losses incurred during this unprecedented security incident. ## The Unknown Compromise Vector While the technical mechanism of the drain is clear, the initial entry point remains unknown. Investigators have not yet determined how the attacker obtained the specific authorizations signed for the exchange's wallets. This missing link in the security chain is critical for understanding how such high-level infrastructure was successfully bypassed by hackers. ## Future Security Implications This incident demonstrates that monitoring standard transfers is insufficient for modern exchange security. Blockaid emphasizes that delegation mechanisms like EIP-7702 require rigorous pre-signature validation. Exchanges must implement stricter policies to verify transaction logic before signing, as attackers are increasingly targeting the complex code interactions inherent in modern blockchain account abstraction standards. ## Sources covering this story - https://incrypted.com/kak-hakery-vyvely-2-5-mlrd-yz-odnogo-koshelka-binance-blockaid-raskryla-mehanyzm-ataky/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._