Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On the evening of 29 October, between $2.5 billion and $3.5 billion in assets left Binance hot wallets on the Ethereum network in just 40 minutes. When Bitcoin and Tron movements are included, the total exceeds $5.57 billion according to Decrypt. The attacker did not extract private keys; instead, EIP-7702 was used to replace the execution code of Binance 14 with a malicious contract, enabling a single sweep transaction to empty the wallet.
Tether and Circle froze approximately $971 million USDT and $823 million USDC within the first hour. By 01:09 Moscow time Tether had increased the freeze to roughly $1.67 billion, bringing the combined blocked amount to about $2.5 billion. Binance is investigating the incident and maintains that user funds are safe; no official attribution has been made.
18 Hours of Preparation and 40-Minute Execution
The attacker prepared for nearly a full day and conducted three rehearsal attacks on unrelated wallets. Gas was pre-funded through three deposits of roughly 0.1 ETH each from Tornado Cash on 28 and 29 October. Key timeline events (UTC):
- 02:29 — deployment of the first contract 0x19be…f2bf
- 13:51 — EIP-7702 delegations to two test wallets followed by sweep tests at 14:20 and 14:24
- 15:59 — deployment of the final malicious contract 0x63e8…6fAe later used against Binance
- 16:21–16:30 — third test on another wallet
- 20:21 — EIP-7702 delegation of Binance 14 to the attacker contract
- 20:24 — main sweep of 167 464 ETH and 63 tokens including 1.615 billion USDT
- 20:24 — Binance 16 sent an additional 28 005.6 ETH to the same recipient
- 20:38 — 195 460 ETH moved in a single transaction to 0x8532…43D4
- 20:41 and 20:59 — additional calls from Binance 14 coincided with 780 million and 43 million USDC leaving Hot Wallet 34
Only three and a half hours separated the final test from the live attack, and just 3 minutes 24 seconds passed between delegation and the main withdrawal.
How EIP-7702 Allowed Code Substitution
EIP-7702 permits an externally owned account to adopt smart-contract code after the owner signs an authorization. From that point, any call to the address executes the delegated code. The attacker deployed contract 0x63e8…6fAe containing a sweep function that transfers ETH and listed tokens to a designated address. A type-4 transaction containing the signed authorization for Binance 14 was submitted at 20:20:59. Three minutes later the sweep function was invoked directly on Binance 14, moving all assets for a gas cost of roughly 0.0004 ETH.
Fund Movements and Freezes
The primary recipient 0x5227…2f8c received assets from Binance 14, Binance 16 and Hot Wallet 34 and still holds approximately 971 million USDT (matching the Tether freeze) and 2 077 ETH. The 195 460 ETH sent to 0x8532…43D4 has not moved. Remaining tokens were distributed to fresh wallets pre-funded with 0.5–1 ETH for gas. Tether ultimately froze around 1.67 billion USDT, indicating some already-fragmented funds were also blocked.
Attribution Indicators
Operational patterns closely match previous operations attributed to TraderTraitor, a subgroup of the North Korean Lazarus collective. Similarities include Tornado Cash gas funding, multiple test sweeps, rapid contract deployment, and the use of a sweep function. Earlier incidents at WazirX, Bybit, Bitget and AFX share comparable tactics. Binance had recently reported blocking several North Korea-linked attacks via fake job interviews. Confirmation may come from future movement of the 195 460 ETH via THORChain, mirroring the Bybit laundering pattern.
Self-Verification and Defensive Recommendations
All data is publicly visible on Etherscan or Blockscout. EIP-7702 delegation can be checked via the eth_getCode RPC method; a response beginning with 0xef0100 indicates delegation and reveals the contract address. Recommended controls for hot wallets include blocking 7702 authorizations, monitoring type-4 transactions, and rapid revocation of delegations.
Related articles
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance reported on October 29, 2026, that attackers stole approximately $6.3 billion in digital assets from its hot wallets, surpassing the previous record of $1.5 billion taken from Bybit in February 2025. The FBI attributed the breach to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which has a history of high-profile operations including the 2014 Sony Pictures attack. The stolen tokens are being converted to Ethereum and laundered through decentralized finance platforms and instant exchangers. Binance covered 90 percent of losses using its SAFU fund, futures insurance reserves, and corporate treasury totaling around $6.34 billion, though this represents replacement of assets rather than recovery from the attackers. Blockchain analysis by TRM Labs linked the operation to prior campaigns against Bybit and KelpDAO through timing patterns and preparatory withdrawals via Tornado Cash. The incident contributed 2.3 percentage points to the Cassandra Index rise to 72, with the largest regional impact observed in East Asia.
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.
EIP-7702 Explained: How Ethereum's New Signature Standard Enables Persistent Wallet Delegation Attacks
EIP-7702, activated in May 2025 as part of the Pectra upgrade, allows Externally Owned Accounts to delegate execution to smart contract code while retaining their original address and private key. The mechanism introduces powerful features such as batch operations, gas sponsorship, and limited permissions, but also creates new attack surfaces when users sign malicious delegations. Attackers exploit social engineering to obtain EIP-7702 authorizations that install sweeper contracts capable of draining ETH, ERC-20 tokens, and NFTs without further signatures. Unlike ERC-20 approvals, the delegation persists on-chain until explicitly revoked and can affect future incoming funds across multiple networks when chain_id is set to zero. Research from 2026 identified over 900 malicious delegated accounts linked to more than $2.3 million in confirmed losses. The standard itself is not inherently vulnerable; risk stems from unsafe contract implementations and user errors when signing authorizations. Users are advised to verify delegations via Etherscan or eth_getCode and revoke them through trusted wallet interfaces when necessary.
Bitget Loses $351 Million in Record 2026 Crypto Theft After Attackers Forge Internal Transfers
Bitget's hot and warm wallets were drained of approximately $351 million on September 24, marking the largest known single crypto theft of 2026. Attackers did not steal private keys but instead forged internal transfer requests that bypassed approval workflows. The stolen assets spanned at least five blockchains, with the largest portion being roughly 103 million XRP worth about $157 million. Bitget's CEO Gracy Chen attributed the incident to North Korean hackers based on IP patterns, behavioral signatures, and on-chain evidence matching prior operations. The exchange maintains a $464 million user protection fund sufficient to cover all losses, while deposits and trading remain unaffected and only withdrawals are temporarily frozen. The case highlights how process-level compromises can bypass even robust key-management controls in cryptocurrency exchanges.