The recent Binance hack stands as one of the largest heists of all time, relying in part on an exploit of wallet delegation functions on the Ethereum network. Investigators tracked how the attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations targeting an address labeled as Binance 14, all signed with the Binance 14 key.
Because Binance 14 operated as a hot wallet in rapid use, the attacker had to submit a wide variety of approvals with differing nonce values. For the delegation to win approval, the nonce value in the authorization transaction—representing a count of the transactions executed by the wallet—had to precisely match the address's current nonce.
Once approved, the sweeper contract executed as if it were the Binance 14 account, enabling the theft of both ether and tokens from the address.
Variations Across Wallets and Chains
Interestingly, other wallets outside of Binance 14 did not rely on this delegation method. The delegation was used primarily for convenience, as the attacker was already able to sign transactions using the Binance 14 key.
For instance, Binance 16 transferred its hacked funds on Ethereum through a standard transaction rather than utilizing delegation. Similarly, attacks involving other Ethereum Virtual Machine (EVM) chains such as Base, Optimism, Arbitrum, Avalanche, and Polygon relied on mundane transfers instead of the delegation tactic.
Binance eventually removed the delegation from the Binance 14 address. Authorities and platforms have frozen or blacklisted approximately $2.4 billion worth of funds removed from Binance wallets on Ethereum.
