ABAB News Logo
Back to Flash News

DiscusFish: Binance 14's EIP-7702 delegation had not been revoked for more than 2 hours, and about 2,961 ETH were still pending

On October 29, 2026, F2Pool and Cobo co-founder DiscusFish (@bitfish) posted that the EIP-7702 delegation of the wallet labeled Binance 14 had still not been revoked after more than 2 hours. He also pointed out that a transfer of about 2,961 ETH into Binance 14 was pending because the gas fee was too low; once the transaction goes on-chain (the base fee falls below 4.4 gwei), the attacker can sweep away this batch of ETH together through the existing delegation.

Earlier the same day, on-chain data showed that after Binance 14 was delegated via EIP-7702 to a contract deployed by the attacker at around 20:20 UTC, about 167,464 ETH and about 1.615 billion USDT and other assets were transferred out in a single transaction at 20:24 UTC. Several on-chain analysts pointed out that the EIP-7702 delegation remains valid until it is revoked through a new valid signature, and that the attacker can continue to call the sweep function to handle subsequently credited assets. Binance officially confirmed that it is investigating a potential security issue and said user funds are safe; Changpeng Zhao said the incident looked like a hack.

DiscusFish's observation is a real-time report on the ongoing on-chain state, and Binance has not yet responded specifically to whether the delegation is still valid or to the pending transaction.

Original sources:

  1. Title: Binance 14's 7702 delegation still hasn't been revoked after more than 2 hours... Publisher: DiscusFish (@bitfish) Publication date: 2026-10-29 URL: https://x.com/bitfish/status/2115941410251882747 Nature of source: original post by the party involved Verification: full post read in this translation, verification date 2026-10-29 Supporting content: DiscusFish said Binance 14's EIP-7702 delegation had not been revoked for more than 2 hours, and about 2,961 ETH were still pending with a risk of being swept

  2. Title: Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702 Publisher: Cryptoticker Publication date: 2026-10-29 URL: https://cryptoticker.io/en/binance-hack-hot-wallet-drained/ Nature of source: media report Verification: related content read in this translation, verification date 2026-10-29 Supporting content: Binance 14 was swept after being delegated via EIP-7702; the delegation mechanism can remain in effect until revoked (background)

  3. Title: User funds are safe! It does look like a hack on Binance... Publisher: Changpeng Zhao (@cz_binance) Publication date: 2026-10-29 URL: https://x.com/cz_binance/status/2115915423174853077 Nature of source: original post by the party involved Verification: full post read in this translation, verification date 2026-10-29 Supporting content: CZ said it appeared to be a hack and user funds are safe (background)

ABAB AI Insight

DiscusFish's observation points to the continued validity of the EIP-7702 delegation. After Ethereum's Pectra upgrade, this mechanism allows an externally owned account to delegate execution rights to a contract, with the delegation state persisting across transactions until the holder of the original private key submits a new valid authorization to revoke it. In the Binance 14 case, the attacker submitted delegation authorizations for multiple nonces in a single type-4 transaction; once successfully triggered, the attacker could repeatedly call the sweep function without needing to obtain a new signature each time.

In terms of capital flow, the hot wallet continues to receive assets from user withdrawals or internal replenishment. If the delegation is not revoked, any subsequent credited ETH or callable tokens can be swept out by the same operator. The pending status of the 2,961 ETH means the funds have not yet been finally confirmed, but once gas conditions are met they enter the range that can be swept. This forms a continuous risk with the already occurred main sweep transaction, rather than a one-time event.

Compared with the 2025 Bybit cold-wallet incident, Bybit completed a one-time large transfer through deception at the signing interface; this case instead uses an already installed delegation to keep exposing subsequent inflows to the hot wallet. Stablecoin issuers have frozen large amounts of USDT and USDC, but native ETH does not have an equivalent freezing mechanism. The key indicator is whether Binance releases on-chain evidence of delegation revocation or hot-wallet isolation.

ABAB News · Cognitive Law

  1. When an EIP-7702 delegation has not been revoked, subsequent inflows to a hot wallet remain in a state that can be swept by the same operator.

  2. The confirmation conditions of a pending transaction extend the attack window rather than signaling that the incident has ended.