TL;DR
- The Binance breach demonstrates how an attacker allegedly leveraged Ethereum’s EIP-7702 authorization capability to siphon roughly $2.5 billion from an Ethereum hot wallet belonging to Binance.
- The perpetrator secured the capacity to transfer assets continuously without needing separate approvals for every single transaction, contributing to a total estimated security event of $6.3 billion.
- Binance encountered one of the largest digital asset breaches in history after a malicious party exploited an Ethereum authorization feature to empty an estimated $2.5 billion from a hot wallet.
The breach zeroed in on a wallet labeled Binance 14, making use of Ethereum’s EIP-7702 capability, which permits externally owned accounts to run smart contract code temporarily without moving to a distinct smart contract wallet.
On-chain data indicates the assailant employed a fraudulent authorization to grant a smart contract authority over the wallet’s transaction processing, converting the exchange’s account into an automated asset-emptying tool.
This event forms a segment of a wider compromise impacting various Binance wallets spanning multiple blockchain ecosystems, with overall losses estimated near $6.3 billion.
How EIP-7702 Enabled the Binance Wallet Drain
Ethereum incorporated EIP-7702 as part of the Pectra upgrade to enhance wallet capabilities and enable functions like account abstraction and transaction batching.
Yet, this same versatility can present critical security dangers if authorization prompts lack adequate verification.
Regarding the Binance situation, blockchain security experts noted that the threat actor prepared 50 EIP-7702 authorization requests directed at Binance 14. Because every authorization tied to a distinct transaction nonce, only one would align with the account’s active sequence. One such authorization was approved, enabling the wallet to run code originating from a harmful sweeper contract.
The Binance breach reveals that the attacker then invoked the contract to shift funds out of the wallet. An initial major transfer moved about 167,464 ETH, along with approximately $1.6 billion in USDT alongside numerous other tokens.
The total worth of the moved assets totaled roughly $2.5 billion.
An investigation by Bitquery revealed that the bad actor kept leveraging the delegated feature to carry out additional transfers throughout subsequent hours.
Binance’s Broader Security Breach Reaches $6.3 Billion
The incident involving the Ethereum wallet represented just a single part of a far grander offensive.
Binance calculated that roughly $6.3 billion worth of digital assets suffered impact across a variety of blockchain networks. An initial inquiry suggested a compromised laptop belonging to a DevOps engineer could have granted entry to internal systems and permitted unauthorized withdrawal commands.
The platform stated it discovered zero proof indicating that wallet private keys suffered exposure.
Concurrently, blockchain security firms spotted abnormal authorization behavior and odd transaction flows across the impacted accounts.
Binance also collaborated with blockchain partners and stablecoin administrators to lock down segments of the pilfered funds. Roughly $3 billion was reportedly frozen, though recovery efforts remained active.
Bitcoinist previously covered the massive Binance hack alongside its projected $6.3 billion fallout.
Ethereum’s Wallet Flexibility Raises New Security Questions
This event underscores a critical balance between expanding digital wallet capabilities and upholding secure authorization workflows.
EIP-7702 brings genuine advantages to Ethereum participants, such as versatile transaction processing. Nevertheless, handing execution authority over to external code implies that dangerous permissions can trigger severe vulnerability if signing mechanisms fail to flag suspicious prompts.
The Binance event does not prove that EIP-7702 has a native flaw. Rather, it illustrates the way an authorized protocol mechanism can be weaponized in an assault when verification safeguards falter.
For the wider crypto sector, this occurrence brings fresh urgency to conversations surrounding transaction validation, operational security, and wallet permissions.
Written by
Yuki Yamamoto
