Binance-Labeled Wallet Swept Minutes After EIP-7702 Delegation
- Published
- Updated
- Since then
- 4 new reports
Binance’s hot-wallet incident has been linked to an EIP-7702 delegation path, with one account later tied to a separate large USDC transfer and investigators still sorting out how the signatures were obtained. New coverage adds a preliminary Binance explanation that points to a compromised DevOps laptop, alongside outside analysis that the withdrawal pattern involved valid authorizations and consecutive nonces.
Key claims & sources
What it means
EIP-7702, live since Ethereum's Pectra upgrade in May 2025, lets a standard externally-owned account temporarily delegate execution to smart-contract code, a feature built for account abstraction such as sponsored gas and batched transactions. Before Pectra, an EOA like Binance 14 could only sign standard transfers, not hand control to arbitrary code. That same delegation path is now the one investigators say moved attacker-controlled logic into a labeled Binance hot wallet.
Exchanges and custodians now have to treat 7702 delegation requests as a distinct signing event requiring separate approval, not a routine transaction. Fireblocks, which confirmed a signed delegation enabled the withdrawals, and other custody providers will need controls that flag or block delegation authorizations from production hot wallets. Binance's own operations team faces a narrower problem: its preliminary finding points to a compromised DevOps laptop, meaning device and credential hygiene, not just smart-contract review, becomes the immediate fix.
The episode exposes a real trade-off: the same delegation mechanism designed to make Ethereum accounts more flexible also widens what a single stolen signature can authorize, letting 50 valid authorizations across consecutive nonces move roughly $2.5 billion in one sweep. It is also a reminder that a centralized exchange's security rests on operational discipline, not blockchain design alone; a laptop compromise, not a protocol flaw, may be the real point of failure, whatever role EIP-7702 played in the blast radius.
The open question is whether the signatures behind the delegation and the separate 780 million USDC transfer from a wallet the same account controls came from the same breach or a different one. Binance's full post-incident report, expected to detail how the DevOps laptop was compromised and whether other signers were exposed, will determine if this stays an isolated operational failure or forces a broader review of how exchanges handle EIP-7702 authorizations.
Market reaction i
The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Cointelegraph
context
Crypto Economy
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.5 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
| 6.4 years ago | Wirecard · Scam incident | $2.1B |
| 5.2 years ago | BitConnect · Scam incident | $2B |
4280 incidents stored · 4 were as large as this one or larger ($2.5B)