Community blockchain trackers estimate that wallets labeled as Binance hot wallets were emptied across at least seven networks in less than an hour, producing claimed outflows of roughly $60 billion. The reconstruction points to a possible compromise of signing infrastructure used to authorize withdrawals, rather than a vulnerability in a public smart contract or a single blockchain.
The reported activity spanned Ethereum, Bitcoin, TRON, Arbitrum, Avalanche, Optimism and Base. Transfers on several networks appeared within the same minute, a pattern that would be difficult to explain through a compromise limited to one wallet type or one chain's software.
On Ethereum, the activity used EIP-7702, an account-abstraction feature that lets an externally owned account temporarily delegate its behavior to smart-contract code. The feature requires authorization signed by the wallet's own key material. That requirement has concentrated attention on the process through which the signatures were generated.
Community analysts following the transactions said the signature pattern was more consistent with an attacker gaining access to an authorized signing path, potentially involving hardware security module, or HSM, and multiparty computation, or MPC, systems. Those systems are designed to protect keys and approve transactions without exposing a full private key in one place.
A straightforward private-key theft could produce valid signatures, but the reported sequence appears to show signatures being issued on demand across several wallet formats and blockchain networks. If accurate, the episode would expose risks concentrated in the systems that authorize exchange transfers, even when the underlying wallets and chains use different cryptographic designs.
EIP-7702 activity focused on Binance 14
The most closely examined Ethereum transaction targeted a wallet labeled "Binance 14." According to the on-chain reconstruction, the attacker submitted 50 EIP-7702 authorization signatures in a single Type-4 transaction, covering a continuous nonce range from 18,914,775 through 18,914,824.
A nonce is a transaction counter that prevents transactions from being replayed. Preparing a range of authorizations could give an attacker room to execute a transaction despite uncertainty over whether the wallet's nonce would change before the attack was completed.
At 20:20:59 UTC on Oct. 29, Binance 14 reportedly delegated its behavior to a sweeping contract. That contract then removed tokens from the address within one transaction and one Ethereum block, while retaining 1 ETH for gas fees.
At 20:24:23 UTC, the wallet transferred 167,464.25 ETH, 1.615 billion USDT and 62 other tokens to an address beginning 0x5227 and ending 2f8c. Etherscan labeled that address "Exploiter 2," according to the supplied transaction analysis.
Twenty-four seconds later, a separate wallet labeled "Binance 16" sent 28,005.6 ETH to the same destination. The close timing is central to the argument that the incident reached beyond one Ethereum account. Binance 16 apparently used a conventional transfer rather than the EIP-7702 delegation mechanism, while Bitcoin and TRON transfers were also initiated around the same period.
By 20:39 UTC, the attacker had reportedly moved a combined 195,470 ETH linked to the two Ethereum wallets.
Cross-chain transfers began within minutes
The first major reported movement occurred on Bitcoin. At 20:20:06 UTC, a hot wallet beginning bc1qm34 sent 18,270.2 BTC in one transaction. A receiving address on TRON was created roughly nine seconds earlier, at 20:19:57 UTC, according to the reconstruction.
A TRON hot wallet then transferred 612.7 million USDT in one transaction at 20:22:45 UTC. The sequence suggests that recipient infrastructure was prepared immediately before the coordinated withdrawals began, rather than built gradually over an extended period.
Between 20:32 and 20:33 UTC, three wallets on Arbitrum and four wallets on Avalanche were reportedly emptied. The first identified Arbitrum movement involved 3,478.4 ETH, while the first Avalanche transfer involved 432,846 AVAX.
The reported losses also extended to a wallet labeled "Binance 34," which held 780 million USDC. That wallet was drained at 20:41 UTC, followed by a further 43 million USDC outflow at 20:59 UTC.
The reconstruction attributes the USDC movements to an administrative relationship between Binance 14 and Binance 34. If Binance 14 controlled Binance 34's administration functions, the EIP-7702 delegation may have enabled the attacker to use that authority after taking over the signing path of the first wallet.
EIP-7702 delegation remains effective until it is overwritten. The analysis says that design allowed the sweeping contract to continue capturing assets sent to Binance 14, with smaller balances reportedly removed until 21:04 UTC.
Activity suggests preparation began at least 37 hours earlier
Blockchain activity linked by community trackers indicates that the operation may have begun well before the large withdrawals. At 07:39 UTC on Oct. 28, an address beginning 0x7c86 and ending 5ca0 withdrew gas funds from Tornado Cash's 0.1 ETH pool in three tranches. The first incoming amount was 0.0983 ETH.
Between 02:28 and 14:19 UTC on Oct. 29, the attacker reportedly deployed an initial Ethereum contract described by trackers as "Sweeper A." Two test wallets were created at 13:51 UTC and funded with $7 million in stablecoins. The wallets were then used in what analysts described as an EIP-7702 delegation rehearsal, with the balances later swept through a single operation.
A final version, called "Sweeper B" in the reconstruction, was deployed between 15:59 and 18:20 UTC. A third test wallet received 1.01 ETH, while a small USDT sweep of 2.54 USDT was executed at 16:30 UTC. By 18:20 UTC, the test funds had reportedly been consolidated back into the original funding pool.
Such testing would fit an operation designed to avoid execution errors during a narrow window of access to a signing system. The alleged attacker appears to have tested both delegation and asset collection before sending transactions against accounts holding much larger balances.
Pressure turns to withdrawal controls
The reported scale of the incident would far exceed the $2.2 billion in cryptocurrency losses from hacks and exploits recorded across 2024 by blockchain security firms and industry trackers. The estimate of $60 billion in outflows remains a community calculation based on wallet labels, asset movements and token balances, and the figure would require careful reconciliation because large transfers can include assets later frozen, recovered or moved between controlled addresses.
The episode raises operational questions for Binance Chief Executive Officer Richard Teng and the exchange's security team, especially over how a single attacker could allegedly trigger valid transfers across networks with different account structures.
The central concern is whether transaction approval systems maintained enough separation between chains, wallet classes and administrative permissions. A compromise affecting a shared authorization layer could bypass those boundaries and turn legitimate withdrawal controls into a route for coordinated asset removal.
Traders with funds on centralized platforms will likely be watching for updates on affected wallets, asset freezes, stablecoin issuer actions and the movement of funds through bridges or conversion services. Large stolen balances do not necessarily enter markets immediately, particularly when addresses are publicly tracked and counterparties can block identifiable funds.
For wallet users, the event also offers a narrower lesson about EIP-7702: delegation approvals can alter how an account behaves until they are replaced. Anyone using compatible wallets should review authorization prompts carefully, verify the destination and contract code involved, and revoke or replace unexpected delegations where their wallet tools support that action.
Concerned about hot wallet risks? Learn key safeguards in this guide to cold vs. hot wallet security.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
