Hoskinson Warns of EIP-7702 Risks Following $6.3B Binance Breach
Delegation functions allegedly accelerated the massive asset drain during the Binance security incident.
1Binance Security Breach Overview
The Binance 14 wallet suffered a massive security breach resulting in a $6.3 billion loss. Investigators are currently analyzing how attackers gained signing access to the hot wallet. While the exact entry point remains under investigation, the speed and scale of the asset drain have raised significant concerns regarding transaction execution mechanisms.
2EIP-7702 Delegation Concerns
Charles Hoskinson highlighted risks associated with Ethereum’s EIP-7702, suggesting the delegation function facilitated the attack. Researcher CyberSatoshi identified that 50 EIP-7702 authorizations were directed at the compromised wallet. This feature allows an Externally Owned Account to delegate execution to smart contract code, effectively turning the wallet into a custom proxy for attackers.
3Custom Sweeper Contract Mechanics
The attackers utilized a custom-engineered sweeper contract specifically designed for the Binance 14 architecture. It left exactly one Ether behind to prevent automated gas error alarms from triggering. This surgical approach ensured that the automated transaction systems continued functioning, allowing the malicious actors to drain tokens without alerting the exchange's internal monitoring.
4Bypassing Standard Defense Systems
Traditional security systems would typically flag multiple transactions, potentially stopping an attack after the third attempt. By using EIP-7702, the attackers sprayed 50 consecutive nonces in a single type-4 payload. This atomic execution allowed them to bypass standard defense triggers, enabling the rapid movement of billions in assets within a single block.
5Vault Access and Asset Targeting
The compromised execution function also targeted an external vault holding $823 million in USDC. The custom code included a callExecute function designed to impersonate the wallet controller. This level of precision indicates that the attackers possessed deep knowledge of the wallet's architecture, allowing them to interact with external assets beyond the hot wallet.
6The Role of Signing Keys
Despite the efficiency of the delegated code, EIP-7702 cannot forge permissions. Attackers still required valid signing keys or access to Binance’s internal signing systems to initiate the delegation. The incident highlights two distinct security failures: the initial acquisition of signing credentials and the subsequent exploitation of delegation features to accelerate asset extraction.
7Ethereum Specification Security Warnings
Ethereum’s official EIP-7702 documentation includes disclaimers regarding the risks of delegated code. It warns that delegates have full access to the account and must be audited rigorously. If contracts are not carefully crafted, malicious parties can control an EOA with minimal limitations, a scenario that appears to have unfolded during this breach.
8Implications for Future Security
The Binance incident serves as a critical case study on the intersection of account abstraction and exchange security. While EIP-7702 offers functional benefits, its potential for abuse in state-sponsored attacks is significant. Future security protocols must account for how delegation functions can be weaponized to bypass traditional transaction monitoring and alert systems.
Original article: CryptoNinjas — Hoskinson Warns of EIP-7702 Risks Following $6.3B Binance Breach