Security firm Blockaid has released analysis of the wallet permissions exploited during Binance's October 29 security incident. According to Blockaid's findings, an attacker used Ethereum's EIP-7702 feature to connect a Binance account to code capable of withdrawing assets.
EIP-7702 allows an Ethereum account to delegate function execution to a smart contract. The attacker delegated the compromised wallet to a contract with functions to withdraw tokens and Ether, authorizing a specific operator address to access these operations. This arrangement gave the operator access to existing funds and any new assets deposited to the account.
The Attack Method
Blockaid's analysis revealed that the attacker submitted 50 different signed authorization variations in a single transaction, each covering consecutive counter values. The counter, known as a nonce, determines whether an authorization can be accepted and changes as transactions are processed on an actively used wallet.
One of the 50 authorization attempts matched the account's counter when the transaction was included on the blockchain, allowing the malicious code to execute.
Binance's Response
Binance reported on October 30 that the incident resulted in approximately $6.3 billion in affected assets, with about $3 billion frozen. The exchange's initial investigation pointed to a potentially compromised engineer's laptop as the cause of the unauthorized withdrawals. Binance has committed to covering losses and said it would release a technical report upon completing its investigation.
