At least $5.5 billion in cryptocurrency was taken from 11 Binance hot wallets across six networks on Oct. 29 after an attacker used Ethereum's EIP-7702 feature to gain persistent, contract-level control of one of the exchange's largest wallets, according to publicly available blockchain records.
The first major sweep removed roughly $2.5 billion from the Ethereum address known as 'Binance 14' at 20:24 UTC. The wallet held 167,464 ETH, $1.615 billion in USDT and about 60 other tokens before the transfer sent nearly all of its balance to a previously unused address, 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c.
Unlike a conventional theft in which a stolen private key is used to sign individual transfers, the attacker first submitted an EIP-7702 authorization that made Binance 14 execute code from a malicious sweeper contract. That delegation remained active after the initial drain, allowing the attacker to take later deposits without obtaining another signature from the compromised wallet.
Stablecoin issuers blocked a substantial share of the assets after the theft. Paolo Ardoino, chief executive of Tether, said more than $1.56 billion in USDT had been frozen. Jeremy Allaire, chief executive of Circle, said about $800 million in USDC was frozen in coordination with law enforcement. Public tracking placed total frozen stablecoins at roughly $2.4 billion within two hours of the initial sweep.
ETH, AVAX, OP and ARB transferred during the attack do not have comparable issuer-controlled freezing mechanisms and remained under the attacker's control.
A delegation turned one key into continuing access
The attacker's method centered on EIP-7702, a feature introduced through Ethereum's Pectra upgrade. It enables an externally owned account, the type of address normally controlled only through a private key, to delegate execution to smart-contract code.
In this case, a leaked or otherwise compromised private key appears to have given the attacker the ability to sign a delegation authorization for Binance 14. The authorization pointed the wallet to a contract deployed earlier that day at 0x63e842B054Bd624a465454D533C33F573e9c6fAe.
The contract had no verified source code, according to blockchain records, but its observable functions allowed an authorized caller to sweep selected tokens and ETH to a receiver address. It also contained a forwarding function capable of calling other contracts. The attacker's operator wallet, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, was listed as the contract's sole authorized caller.
EIP-7702 delegations are linked to an account address and stay in place until they are replaced or explicitly cleared. Rotating the compromised private key alone would therefore not remove the delegated code from Binance 14. Removing it requires a fresh authorization that redirects the account to the zero address.
That persistence gave the attacker a second opportunity at 21:44 UTC, when another sweep removed an additional $200 million in USDT and 13 other tokens that had reached Binance 14 after the first theft.
Nonce spraying targeted a live exchange wallet
Blockchain records show the attacker sent a type-4 transaction to Binance 14 at 20:20:59 UTC containing 50 EIP-7702 authorizations. Each authorization carried a different nonce, the transaction sequence number used to prevent replay attacks.
The nonces ranged from 18,914,775 through 18,914,824. Only one matched Binance 14's live nonce; the other 49 were invalid. The approach allowed the attacker to account for a wallet that was continuing to process routine withdrawals, without knowing its exact transaction count in advance.
The valid delegation became active while the wallet continued sending normal outbound transactions. Three minutes and 24 seconds later, the attacker called the sweeper contract and drained the wallet, leaving behind 1 ETH.
Twenty-four seconds after Binance 14 was emptied, another Ethereum wallet known as Binance 16 sent 28,005.6 ETH, $55.7 million in USDT, $25.9 million in RLUSD, 84.5 WBTC and five other tokens to the same receiving address.
The rapid consolidation extended beyond Ethereum. Over the following 12 minutes, blockchain records show four Arbitrum wallets transferred 74.6 million ARB and 8,426 ETH, while a Binance wallet on Optimism sent 44.2 million OP. Four Avalanche wallets transferred 1.81 million AVAX and $8.41 million in USDT.
These wallets did not carry delegated code, based on the supplied onchain account data. Their transfers were standard transactions signed by the wallets' own keys and mixed among routine exchange withdrawals, pointing to a broader private-key compromise rather than an EIP-7702 exploit affecting every address.
USDC held through a smart account was also swept
At 20:41 UTC, the attacker used the delegated Binance 14 address to move 780 million USDC and then another 43 million USDC from a Circle smart account labelled 'Binance Hot Wallet 34.' The account was controlled through Binance 14, allowing the attacker to reach assets associated with that linked structure.
Public trackers also attributed 18,270 BTC on Bitcoin and approximately $630 million on TRON to the same actor, although those portions were described as pending further threat-intelligence confirmation.
The operator wallet had received funding through three Tornado Cash withdrawals beginning on Oct. 28. On Oct. 29, before the main theft, it rehearsed the delegation-and-sweep sequence with three personal wallets, moving only $2 to $6 in each test. The sweeper contract was deployed at 15:59 UTC, several hours before it was used against Binance 14.
Monitoring detected the onchain changes quickly
Security monitoring systems identified the initial sweep 1 minute and 55 seconds after it occurred, according to the incident timeline. Automated analysis linked the event to private-key compromise and the EIP-7702 delegation within 11 minutes, while addresses were labeled malicious and shared through an incident feed within an hour.
The incident offered several visible warning signs: Binance 14 changed from an account with no code to one carrying a delegation pointer; billions of dollars moved to a fresh address; and assets from several networks converged on that receiver within minutes. Cross-chain movements were reportedly detected within seven seconds.
Before Oct. 29, four verified EIP-7702-related incidents in 2026 had produced combined losses of roughly $1.08 million. The Binance theft places the feature's security risks on a vastly different scale, particularly for high-volume hot wallets whose transaction activity makes nonce-spraying practical.
For wallet operators, the episode shows that monitoring outgoing transfers alone may not be enough. A suspicious delegation can appear onchain before a drain begins, and an account holding large balances may need controls that detect or block unexpected EIP-7702 authorizations before delegated code gains access to its funds.
Strengthen your defenses after this Binance exploit—learn practical protection steps in this crypto security breaches guide.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
