Blockaid: Attackers paid about $15 in fees to transfer about $2.5 billion from Binance in a single transaction using EIP-7702
Security company Blockaid said that on October 29, 2026, attackers used Ethereum’s EIP-7702 feature and paid about $15 in network fees to set authorization for Binance’s 14 hot wallets, then transferred about $2.5 billion in assets in a single transaction, accounting for about 40% of the total stolen amount.
The transaction included 167,464 ETH and more than 60 other tokens, including about $1.6 billion in Tether’s USDT. In its preliminary investigation announced on November 3, Binance confirmed that the total affected assets were about $6.34 billion, spread across multiple blockchains; the attackers obtained unauthorized access to an internal signing service through fake recruitment and social engineering rather than directly leaking private keys. Binance said it would fully cover the losses and has frozen or intercepted about $2.85 billion.
EIP-7702 went live with the Pectra upgrade in May 2025, allowing ordinary accounts to temporarily delegate smart contract code execution and enabling batch operations and fee sponsorship. The attackers submitted authorization signatures for 50 consecutive nonces, and one matched successfully, directing the wallet to a sweep contract controlled by the attackers. Binance revoked the delegation through a new authorization about 3 hours and 50 minutes later.
Original sources:
Title: Hackers paid $15 to drain $2.5 billion from Binance in one hit Publisher: Bloomberg (republished by Moneycontrol) Publication date: 2026-11-06 URL: https://www.moneycontrol.com/news/cryptocurrency/hackers-paid-15-to-drain-2-5-billion-from-binance-in-one-hit-14072221.html Nature of source: media report Verification: related passages actually read for this report, verified on 2026-11-06; full text limited by page truncation Supporting content: supports the core facts that about $15 in fees set up the EIP-7702 authorization, about $2.5 billion was transferred in a single transaction, Binance had 14 wallets, Blockaid made the attribution, and the stolen total was about 40%, among others
ABAB AI Insight
EIP-7702 was proposed by Vitalik Buterin and others as a transitional step toward full account abstraction and went live on the mainnet with the Pectra upgrade on May 7, 2025. It allows an existing EOA to temporarily execute deployed contract code through signature authorization, without moving the address, and thereby gains batch transaction and fee sponsorship functionality. The Binance incident shows that once a signing service for an exchange hot wallet is compromised, this mechanism can enable large-scale single-shot draining at very low network cost, while expanding execution rights from a single signature to a continuously valid on-chain delegation.
Similar to the Bybit incident of about $1.5 billion in February 2025, analysis firms and the FBI attributed this case to the North Korea-related organization TraderTraitor. The core path in both cases was entry into internal signing infrastructure through fake recruitment and malicious software, rather than a vulnerability in the protocol itself that could be arbitrarily exploited. Binance uses MPC hot wallets, so no single private key could be directly leaked; however, once the signing service was abused, an EIP-7702 authorization, once on-chain, continued to take effect independently of the internal approval process until it was explicitly revoked.
The key difference from Bybit in this case is that EIP-7702 allowed the attackers to prepare authorizations for 50 consecutive nonces in advance and submit them all at once; once one matched successfully, an external address could trigger automated sweeping. Transfers on other chains still depended on ordinary valid signatures. This increased the scale and speed of a single transaction, but also made revocation depend on an additional on-chain transaction, lengthening the window for asset outflow.
For exchanges holding large amounts of assets in hot wallets, account-abstraction-style upgrades expand risk from single-signature approval to independent execution after delegation, even as they improve user experience. Signing policies must cover EIP-7702-style authorizations and have real-time detection and rapid revocation capability; otherwise, the cost of sweeping after a hot wallet compromise can drop to the level of network fees. A metric to watch next is whether major exchanges impose whitelists, limits, or mandatory immediate revocation mechanisms on delegated authorizations.
ABAB News · Law of cognition
The delegation mechanism turns a one-time signature into continuous execution rights, reducing sweeping costs to the level of network fees after a signing-layer compromise.
While account abstraction improves convenience, it also expands the operating window after a hot wallet is abused.