A major hack targeting Binance’s Ethereum wallets utilized the EIP-7702 delegation feature to compromise at least one specific address. The attacker deployed a sweeper contract and sent multiple authorizations signed with the compromised key to match the wallet’s transaction nonce, allowing the contract to act as the account and drain funds.
While this delegation method was used for the primary target, other affected wallets on Ethereum and various EVM chains like Base and Polygon were drained through standard transfers. Binance has since suspended withdrawals and successfully removed the unauthorized delegation, resulting in the freezing or blacklisting of approximately $2.4 billion in assets.
Key facts
- The attack exploited EIP-7702 wallet delegation on Ethereum to target the Binance 14 address.
- Attackers sent 50 authorizations with varying nonce values to approve a sweeper contract.
- Other wallets on Ethereum and EVM chains were compromised via regular transfers rather than delegation.
- Binance suspended withdrawals during the incident to mitigate further losses.
- Approximately $2.4 billion in funds have been frozen or blacklisted following the exploit.
- The unauthorized delegation on the targeted address was eventually removed by Binance.
Why it matters
The suspension of withdrawals represents a direct operational consequence for users while the exchange secures its infrastructure and attempts to recover or freeze the stolen assets.