EIP-7702 Delegation Enabled a Binance Hot-Wallet Sweep of ETH and Tokens

An EIP-7702 delegation enabled a single Ethereum transaction to move 167,464 Ether (ETH) and 63 token balances from Binance 14 on Oct. 29, with the source of the authorization unconfirmed.

The setup transaction landed at 4:20:59 p.m. ET (20:20:59 UTC). Three minutes and 24 seconds later, the sweep moved the assets, including 1.615 billion Tether (USDT).

The setup carried 50 pre-signed authorization entries for consecutive nonces, but one matched Binance 14’s live nonce. EIP-7702 lets an Ethereum account delegate execution to code using a signed authorization; the feature does not explain how the signature was obtained.

Binance said its preliminary investigation suggested a compromised DevOps engineer’s laptop may have enabled access to a service container used to submit unauthorized withdrawals. The exchange also said it found no evidence of a wallet private-key leak. In an Oct. 30 update, Binance estimated the broader incident’s impact at about $6.3 billion and said about $3 billion had been frozen on-chain.