Analyzing the Binance Hack Mechanics and EIP-7702 Exploitation
Understanding how attackers leveraged pre-signed authorizations during the recent Binance security breach.
1The EIP-7702 Mechanism
The attacker submitted a single transaction containing 50 EIP-7702 authorizations, all signed by a Binance hot wallet. These authorizations pointed to a sweeper contract controlled by the attacker. By pre-signing 50 consecutive nonces, the attacker ensured that at least one authorization remained valid despite the wallet's rapidly changing nonce during high-volume exchange operations.
2Execution and Asset Sweeping
Three minutes and 24 seconds after the initial submission, the operator triggered the delegated hot wallet to transfer 167,464 ETH and 63 tokens, including 1.615 billion USDT. Because the delegation remained active, subsequent deposits were automatically swept at multiple intervals between 20:41 and 23:56 UTC, demonstrating the persistence provided by the EIP-7702 delegation.
3Multi-Chain Breach Scope
The incident was not limited to Ethereum. Binance wallets on Bitcoin, Tron, XRP Ledger, Solana, and various L2s like Arbitrum and Optimism also sent funds to the attacker via standard signed transfers. This confirms that the attacker possessed the ability to force Binance's signing system to authorize transactions across diverse blockchain architectures simultaneously.
4Root Cause Analysis
Binance reported that a compromised DevOps engineer's laptop allowed access to a service container, which then submitted unauthorized withdrawals. Crucially, no private keys were leaked. EIP-7702 was merely a tool used to accelerate the Ethereum-specific theft and ensure persistent access, rather than being the underlying vulnerability that enabled the initial system breach.
5Preparation and Testing
The attack was highly orchestrated, with preparations beginning approximately 36 hours before the main event. The operator used small Tornado Cash withdrawals to fund the wallet, while the sweeper contract was test-deployed and rehearsed on three separate wallets. This methodical approach ensured the final execution on the Binance hot wallet succeeded without errors.
6Smart Account Involvement
Beyond the hot wallet exploitation, the same attacker acted as the executor on a separate Binance smart account. This allowed them to pull 823 million USDC. While Circle successfully froze these assets shortly after the transfer, the event highlights the risks associated with compromised execution permissions within smart account infrastructure and custody setups.
7Detection and Monitoring
Detecting EIP-7702 delegation is technically trivial, as it involves code appearing at an address that should typically remain an EOA. However, most treasury monitoring systems currently lack alerts for unexpected delegation code. This gap allowed the attacker to maintain control over the hot wallet's incoming deposits for several hours post-breach.
8Security Policy Implications
The incident raises critical questions for institutional custody. Should signers and policies reject EIP-7702 authorizations by default unless explicitly expected? Furthermore, the batching of nonces presents a specific risk vector that treasuries must address. Ultimately, this highlights that while new standards evolve, the core risk remains a compromised signer within the infrastructure.
Original article: Ethereum — Analyzing the Binance Hack Mechanics and EIP-7702 Exploitation