Binance Hot-Wallet EIP-7702 Delegation Hack

On October 29, 2026, Binance suffered what analysts call the largest theft in crypto history when an attacker hijacked one of its primary Ethereum hot wallets via an EIP-7702 delegation and swept an estimated $6.3 billion across several chains.

What happened

At 20:20:59 UTC the attacker submitted a single EIP-7702 (type-4) transaction carrying 50 authorizations signed with the key of "Binance 14" (0x28C6…1d60), one for each nonce from 18,914,775 to 18,914,824. Forty-nine were invalid and one took effect, delegating the wallet to an attacker-deployed sweeper contract (0x63e8…6fAe) that had been deployed hours earlier. At 20:24 UTC the sweeper moved roughly $2.5 billion from Binance 14 — 167,464 ETH, 1.615 billion USDT and about 60 other tokens — leaving 1 ETH for gas. Within minutes, ten more Binance hot wallets across Ethereum, Arbitrum, Avalanche, Optimism, Tron and Bitcoin forwarded funds to the same collector address. The operator address had been funded through three Tornado Cash withdrawals the day before. Binance put total exposure at roughly $6.3 billion; Blockaid and other public tallies put the figure near $5.5 billion.

Aftermath

Binance temporarily suspended withdrawals, said deposits were unaffected, and pledged to cover all user losses from its SAFU fund and company reserves. Stablecoin issuers reacted fast: Tether froze more than $1.5 billion in USDT and Circle over $800 million in USDC, with Binance estimating roughly $3 billion frozen across assets — though ETH, AVAX, OP and ARB could not be frozen. A preliminary Binance update pointed to a possibly compromised DevOps engineer's laptop as the entry point; Binance said it found no evidence of a leaked wallet private key, and a full post-mortem is planned. No attacker has been publicly confirmed.

Why it matters

This is the catalogue's first entry where EIP-7702 account delegation was weaponized at scale: rather than exploiting a protocol bug, the attacker turned Ethereum's new account-abstraction primitive into a one-signature wallet takeover. It reframes the exchange hot-wallet threat model, echoing how operational key and access compromise — not smart-contract flaws — drive the biggest custodial losses, as seen with Bitget and Duelbits. It also shows the growing importance of issuer-level freezes as a last line of defense once funds leave custody.