Binance suffered a major cryptocurrency security incident after an attacker exploited Ethereum's EIP-7702 authorization feature to drain approximately $2.5 billion from one of its hot wallets, identified as Binance 14. The attack is part of a wider security breach affecting multiple Binance wallets across several blockchain networks, with total estimated losses reaching approximately $6.3 billion.
How the EIP-7702 Attack Worked
EIP-7702 is an Ethereum feature introduced as part of the Pectra upgrade to improve wallet functionality and support features such as transaction batching and account abstraction. The mechanism allows externally owned accounts to temporarily execute smart contract code without migrating to a separate smart contract wallet.
According to blockchain analysis, the attacker prepared 50 EIP-7702 authorization requests targeting Binance 14, each associated with a specific transaction nonce. One authorization was accepted, allowing the wallet to execute code from a malicious sweeper contract. The attacker then used this delegated functionality to transfer assets out of the wallet.
The first major transaction moved approximately 167,464 ETH, alongside roughly $1.6 billion in USDT and dozens of other tokens, with the combined value reaching approximately $2.5 billion. The attacker continued executing additional transfers over the following hours using the same delegated functionality.
Broader Breach and Recovery Efforts
Binance's preliminary investigation pointed to a potentially compromised DevOps engineer's laptop, which may have provided access to internal infrastructure and enabled unauthorized withdrawal requests. The exchange stated it had found no evidence that wallet private keys were leaked.
Blockchain security companies identified unusual authorization activity and suspicious transaction patterns across the affected wallets. Binance coordinated with stablecoin issuers and blockchain partners to freeze portions of the stolen assets, with approximately $3 billion reportedly frozen at the time of reporting, though the recovery process remained ongoing.
Security Implications for Ethereum Wallets
The incident highlights the tension between introducing greater functionality into cryptocurrency wallets and maintaining secure authorization processes. While EIP-7702 offers legitimate benefits for Ethereum users through more flexible transaction execution, delegating execution to external code means that malicious permissions can create significant exposure if signing systems fail to identify suspicious requests.
The Binance incident does not establish that EIP-7702 itself contains a vulnerability, but rather demonstrates how a legitimate protocol feature can become part of an attack when authorization controls are compromised. For the cryptocurrency industry, the breach underscores the importance of transaction verification, wallet permissions, and operational security practices.
