Community Trust ScoreLikely Real
Binance lost an estimated $6.3 billion in digital assets during a coordinated attack in October, a breach that exposed critical vulnerabilities in how the exchange manages on-chain permissions. The incident, which began with a compromised engineer in June, culminated in a massive drain of hot wallets on 29th October, despite Binance’s attempt to suspend withdrawals to protect customer funds.
EIP-7702 Delegation Bypassed Controls
The core of the failure lay in the use of EIP-7702, an Ethereum Improvement Proposal that allows accounts to delegate execution rights to smart contracts. Attackers exploited this mechanism to delegate execution to malicious code on an Ethereum hot wallet. According to Binance, 50 signed transactions were involved in manipulating the account’s nonce and establishing this delegation. This action effectively gave the attackers control over the wallet’s transaction capabilities, bypassing the exchange’s internal withdrawal suspensions.
“Pausing withdrawals turns off the exchange’s own software, but it does nothing about permissions the attacker has already written to the blockchain,” said Brian Cubellis, Chief Strategy Officer at Onramp. The exchange’s hot wallets utilized multi-party computation (MPC), a security model that avoids single private keys but also meant there was no single key available to immediately revoke the malicious delegation. Engineers had to develop a specialized revocation procedure during the incident, a process that took additional time to execute.
Attack Timeline and Drain
The intrusion began months before the main attack. In June, an engineer downloaded a tampered installation package for an AI coding tool. By September, another engineer was approached through a fictitious recruitment process involving interviews and a malicious coding assignment. On 20th October, attackers used compromised employee systems and internal AI tooling to gain access to additional machines, ultimately obtaining credentials to Binance’s wallet signing infrastructure.
The main drain occurred between 20:05 and 20:09 UTC on 29th October. During this four-minute window, hot wallets transferred 223.46 million XRP, 970,500 SOL, and 44.2 million OP to attacker-controlled addresses. The final reported unauthorized Ethereum transfer of 2,961.9 ETH was confirmed on-chain at 23:56 UTC. It was not until 00:10 UTC on 30th October that Binance cleared the malicious EIP-7702 delegation by issuing a new authorization to the zero address, effectively revoking the attacker’s control.
Deposit Consolidation and Recovery
Even after the initial theft, the exchange’s deposit system continued sending funds to the compromised wallet. Four Pillars reported on 4th November that Binance’s deposit-consolidation system kept collecting funds into a compromised Ethereum wallet identified as Binance 14. Nexus Mutual noted that at approximately 21:44 UTC, the attacker swept 200 million USDT that had been deposited roughly 72 seconds earlier.
Chainalysis described an attempt by the attackers to move approximately $500 million in stablecoins through a swapping address. Within roughly 20 minutes, they converted around $325 million into assets less susceptible to issuer freezes, including Ether. The remaining $175 million of the attempted stablecoin movement was frozen. Stablecoin issuers such as Tether and Circle can freeze tokens at designated addresses, a capability that does not exist for assets like Bitcoin or Ether.
Binance reported on 3rd November that approximately $2.85 billion had been frozen or intercepted. By 4th November, the exchange stated it had replenished approximately 98% of the affected holdings through replacement purchases. The incident serves as a stark reminder of the risks associated with smart contract delegations. “An exchange should prove, before it is attacked, that it can cancel any permission on its wallets and move exposed funds to safety even if its own signing system has been taken over,” Cubellis added.
The breach echoes earlier incidents in the industry. In February 2025, Bybit suffered a hack where attackers stole approximately $1.5 billion after compromising its Safe{Wallet} approval process. Bybit’s forensic disclosure stated that malicious changes deceived signers into approving an unauthorized transaction, though its investigators found no indication that its own infrastructure had been compromised. As exchanges continue to integrate smart contract functionality, the security of delegation permissions remains a critical area of focus.
