Blockchain investigators have pieced together how attackers used a single feature from a recent Ethereum upgrade to help drain an estimated $2.5 billion from a Binance hot wallet — part of a wider $6.3 billion Binance hack on October 29, potentially the largest crypto theft in history.
According to security firm Blockaid, the attacker effectively “reprogrammed” a major Binance Ethereum hot wallet so a single operator could drain it.
EIP-7702: The Ethereum Feature Behind the $2.5B Drain
The mechanism was EIP-7702, introduced with Ethereum’s Pectra upgrade in May 2025. It lets an ordinary wallet authorize smart-contract code to act on its behalf.
Blockaid found an Ethereum transaction carrying 50 pre-signed EIP-7702 permissions aimed at “Binance 14,” one of the exchange’s busiest hot wallets. Only one matched the wallet’s current transaction number — and that was enough. The permission let an attacker-controlled contract sweep 167,464 ETH, 1.615 billion USDT and 62 other tokens in a single call, valued at about $2.5 billion by Blockworks.
What Investigators Believe Happened Next
Blockaid CEO Ido Ben-Natan said the evidence points to “key misuse” — a compromised signing process — rather than a leaked private key. TRM Labs linked the broader attack, with high confidence, to North Korea’s TraderTraitor unit, part of the Lazarus Group, though Binance has not confirmed attribution.
Binance said its early findings point to a compromised laptop belonging to a DevOps engineer. The exchange pledged to cover all customer losses through its SAFU fund, froze roughly $3 billion in assets (Tether froze 1.567 billion USDT, Circle over 800 million USDC), and paused withdrawals while systems are upgraded.
Binance exchange (Credits: CoinDesk)
Also Read: Binance Hack Rattles Crypto as Intel Plunges 23% and AI Spending Fears Hit Tech Stocks | Binance Hack Drained Wallets Backing Customer Assets, Reserve Data Shows ETH Backing Slips to 94%
Source: CoinDesk — read the full story there.
