Binance Hack Explained: How 50 Pre-Signed EIP-7702 Requests Drained $2.5 Billion in 4 Minutes — and the 5-Second Wallet Check

One signature out of 50 drained $2.53 billion from a single Binance wallet in under four minutes — and no private key was ever stolen. On October 29, 2026, attackers turned an Ethereum feature designed to make wallets smarter into the key to the largest crypto theft in history, moving roughly $6.3 billion out of Binance hot wallets across ten blockchains in about 20 minutes. If you hold crypto on Ethereum or any EVM-compatible chain, the same mechanism exists in your wallet right now — and a five-second check tells you whether you are exposed.

This is not another story about a leaked password or a phishing email. Binance says it has found no evidence that any wallet private key leaked. Instead, investigators say the attackers got Binance's own signing infrastructure to sign away control of a hot wallet, then used a little-known Ethereum upgrade called EIP-7702 to keep that control for nearly four hours. Here is what happened, how the trick worked, and exactly what to check on your own wallet today.

What Actually Happened on October 29

Binance dates the attack to approximately 20:05 UTC on October 29, 2026. Over the next few hours, roughly $6.3 billion was moved out of 17 Binance hot wallets across ten blockchains, including Bitcoin, Ethereum, XRP, Solana and Tron. Security researchers at TRM Labs put the total at about $6.36 billion, while Blockaid estimated at least $5.5 billion in the wider incident — either way, it is roughly four times the $1.5 billion Bybit hack of February 2025, which US authorities attributed to the same North Korean cluster, TraderTraitor.

The most dramatic single moment came on Ethereum. At 20:20:59 UTC, a transaction carrying 50 pre-signed EIP-7702 authorizations targeted the hot wallet labelled "Binance 14" on Etherscan. At 20:24:23 UTC — less than four minutes later — the attacker's sweeper contract emptied it in a single call: 167,464 ETH, 1.615 billion USDT, 62.6 million RLUSD, 29,934 WBETH, 11,372 XAUT and dozens of other tokens, valued by Elliptic at about $2.53 billion. The delegation then stayed live for 3 hours and 50 minutes, allowing six further withdrawals without any new signature, before Binance's team revoked it at 00:10 UTC on October 30.

Time (UTC, Oct 29–30)	What happened
20:05	Unauthorized withdrawals begin across Binance hot wallets on ten blockchains
20:20:59	One transaction submits 50 pre-signed EIP-7702 authorizations for the "Binance 14" wallet
20:24:23	Sweeper contract drains Binance 14 in a single call worth about $2.53 billion
20:41 and 20:59	Two transfers totalling 823 million USDC leave a separate Binance smart account reachable through Binance 14's permissions
00:10 (Oct 30)	Binance revokes the EIP-7702 delegation, ending nearly four hours of attacker control
Nov 1	Binance begins restoring withdrawals in phases, saying it has replaced about 95% of the stolen assets

What Is EIP-7702, in Plain English

EIP-7702 arrived with Ethereum's Pectra upgrade in May 2025. In plain terms, it lets an ordinary wallet — an externally owned account, or EOA — temporarily borrow smart-contract code and behave like a smart wallet, without changing address. You sign a short authorization naming a contract, and the network writes a small pointer, called a delegation indicator, onto your account. From then on, calls to your wallet run that contract's code, in the context of your balance.

The legitimate uses are genuinely useful: batching several actions into one transaction, letting someone else sponsor your gas fees, adding session keys or spending limits. That is why wallets have been adopting it. But there is a catch that matters enormously: a token approval covers one token for one app, while an EIP-7702 delegation hands a contract control of your whole account. If the contract is malicious, it can move everything — ETH and every token — in a single call.

Two more details made this feature dangerous in the wrong hands. First, a delegation persists until it is replaced or revoked; it does not expire on its own. Second, an authorization signed with a chain ID of zero is valid on every EVM chain that supports EIP-7702, so one bad signature can potentially expose the same address on many networks at once. Ethereum's own guidance warns about exactly this.

The 50-Signature Trick: Nonce Spraying Explained

Here is the cleverest part of the attack, and the part every wallet user should understand. An EIP-7702 authorization is only valid if its nonce — the running count of the wallet's transactions — matches the wallet's current nonce at the moment it is included on-chain. Binance 14 was an active hot wallet firing off withdrawals constantly, so its nonce was changing minute by minute. The attackers could not predict the exact nonce.

So they did not try. According to Blockaid's on-chain analysis, they pre-collected 50 authorizations, each delegating Binance 14 to their sweeper contract, covering 50 consecutive nonces (18,914,775 through 18,914,824), and submitted all of them in a single type-4 transaction. Forty-nine were invalid. One matched the wallet's live nonce — and that one took effect. Security researchers call this "nonce spraying": instead of picking the lock, you try 50 keys at once and let the blockchain tell you which one worked.

Three and a half minutes after the delegation took effect, the sweeper contract was called with a list of 65 token addresses, and Binance 14 was emptied. The delegation then remained in place for hours, which is why later customer deposits landing in the wallet could also be swept. Binance co-CEO Richard Teng has said the attacker "did not simply use one engineer's permissions" and that this "was not a single one-click action" — the full internal picture is still emerging.

Why No Stolen Private Key Makes This Scarier

Binance's initial finding is that the incident may have started with a compromised DevOps engineer's laptop, which reached an internal service able to submit withdrawals. The attacker then used the signing infrastructure itself. That distinction matters for everyone, not just exchanges: protecting keys is not the same as controlling who can use them. Anyone who can get a signing system to sign can move funds, however well the keys themselves are protected.

The same logic applies to your own wallet. Every EIP-7702 delegation needs the wallet's own valid signature — so if you see a delegation you did not authorize, either your key leaked or something that holds it signed when it should not have. And here is the uncomfortable part for ordinary users: the signing screen for a delegation can show little more than a 32-byte digest. You cannot easily tell from the prompt whether you are approving a routine upgrade or handing over your whole account. Standard approval-revocation tools, which watch for approve() and permit() calls, do not catch account-level delegation at all, because it operates at a different layer.

That is also why the usual advice — "just revoke old approvals" — is not enough anymore. Revoking token approvals is still worth doing, but it will not remove a delegation. And researchers have warned that most delegations seen in the wild are scam-linked: Etherscan's June 2025 guide to EIP-7702 smart accounts noted that over 97% of all delegations at the time were linked to scams targeting vulnerable users.

What Happened After: Freezes, Replacements and Withdrawals

The aftermath moved fast. Stablecoin issuers froze a large share of the stolen funds — Binance reported more than $2.54 billion frozen in the early hours — and Binance says it has allocated more than $6.34 billion of company funds to cover the incident, replacing approximately 95% of the stolen assets. Withdrawals, suspended during the emergency, began returning in phases on Sunday, November 1. Reuters reported on November 2 that customers had withdrawn a net $3.64 billion as services resumed, while Binance said withdrawals were stabilising.

For context on what this means for exchange users generally, our earlier coverage of Binance's proof-of-reserves report walks through the tests any exchange transparency report must pass — and why a reserves snapshot alone does not prove your funds are safe. The deeper lesson of this hack is that exchange security is now a signing-pipeline problem, not just a key-storage problem, and the industry's post-mortem will be watched closely. Our Binance proof-of-reserves breakdown explains the five checks that matter.

The 5-Second Wallet Check (Do This Today)

Here is the payoff: checking your own exposure takes seconds, and it costs nothing unless you need to revoke something. Work through this checklist in order.

1. Open Etherscan and paste your wallet address. Find the "Delegated Address" field on your account page. If it shows "null" or nothing, you have no delegation — you are clear on Ethereum.
2. Recognize what you see. A known wallet contract, such as MetaMask's EIP-7702 Delegator, simply means you switched on that wallet's smart-account feature. That is expected.
3. Revoke anything you do not recognize. Reset the delegation from inside your wallet app — this delegates to the zero address and returns your account to a plain wallet. An on-chain revoke typically costs about the same gas as a normal transfer.
4. Repeat on every EVM chain you use. Because a chain-ID-zero authorization can be valid everywhere, check the same address on other networks where you hold funds.
5. If you do not remember signing it, treat the wallet as compromised. Move everything to a fresh wallet. Revoking alone will not save a wallet whose key has leaked, because whoever holds the key can sign a fresh delegation a minute later.

What Most People Get Wrong About This Hack

Myth 1: "Ethereum itself was hacked." As of October 30, no flaw in EIP-7702 itself had been reported. The delegation carried the wallet's own valid signature — this was a signing-side failure, not a broken protocol. Blaming the upgrade misses the real lesson.

Myth 2: "Only exchanges need to worry." The same delegation mechanism exists in every EOA wallet. Phishing sites have already used fake "upgrade your wallet" prompts to trick ordinary users into signing malicious delegations, with individual losses reported well over $1 million.

Myth 3: "Revoking token approvals protects me." It does not touch delegations. You need the separate Etherscan delegation check above — approval tools and delegation checks look at different layers of your account.

Myth 4: "Binance users lost everything." Binance says it has replaced about 95% of the stolen assets from company funds and SAFU reserves, and withdrawals resumed November 1. The lasting damage is to confidence and to the industry's assumptions about signing security, not to Binance customer balances — so far.

What Happens Next

Three things to watch. First, Binance's full post-mortem: how a DevOps laptop reached production signing infrastructure is the question the whole industry needs answered, and it will likely reshape how exchanges isolate signing systems. Second, wallet design: expect louder warnings for type-4 delegation transactions, expiry timestamps on delegations, and one-tap revoke buttons to become standard. Third, regulation: an event this large, attributed by researchers to a North Korean cluster, will feed directly into the ongoing debate over exchange security standards — and into the lessons of earlier scams, like the fake-SEC-filing fraud our FBI scam-site guide covers.

The broader context matters too. Bitcoin has now existed for 18 years since the whitepaper — our guide to Satoshi Nakamoto and the untouched $100 billion fortune traces how the network survived every previous crisis. This hack does not break Bitcoin or Ethereum. It breaks one assumption: that keeping your private key safe is the same as keeping your money safe. From now on, what you sign matters as much as what you store.

Frequently Asked Questions

What is EIP-7702?

EIP-7702 is an Ethereum upgrade from the May 2025 Pectra hard fork that lets an ordinary wallet temporarily delegate to smart-contract code, so it can batch transactions, accept sponsored gas fees and use session keys — without changing address. It works through a signed authorization that writes a delegation pointer onto the account.

How did the Binance hackers use EIP-7702?

They submitted 50 pre-signed authorizations covering 50 consecutive nonces for the Binance 14 hot wallet in a single transaction. One matched the wallet's live nonce, delegating it to their sweeper contract, which then drained about $2.53 billion in one call. The delegation stayed live for 3 hours 50 minutes, allowing further withdrawals.

Was any private key stolen in the Binance hack?

Binance says it has found no evidence that any wallet private key leaked. Its initial finding points to a compromised DevOps engineer's laptop reaching an internal service able to submit withdrawals, after which the signing infrastructure itself signed the attacker's authorizations.

How do I check if my wallet has a malicious delegation?

Paste your address into Etherscan and look for the Delegated Address field. "Null" means no delegation. A known contract from your own wallet app is normal. An unrecognized contract should be revoked from inside your wallet app, and if you do not remember signing it, move your funds to a fresh wallet.

Does revoking token approvals remove an EIP-7702 delegation?

No. Token approvals and account delegations operate at different layers. Revocation tools that watch approve() and permit() calls do not catch delegations — you must check and reset the delegation itself, as described above.

Are Binance users' funds safe now?

Binance says it has replaced approximately 95% of the stolen assets with company funds and SAFU reserves, and withdrawals resumed in phases from November 1, 2026. A full post-mortem is still pending, and users should follow official Binance notices for the latest status.

Conclusion

The Binance hack will be remembered as the day crypto learned that signatures are the new private keys. Fifty pre-signed authorizations, one lucky nonce, one $2.53 billion sweep — and a feature built to make wallets smarter became the weapon that emptied one. The good news is that the defence is simple and free: check your Delegated Address on Etherscan today, revoke what you do not recognize, and never sign a wallet "upgrade" prompt you did not ask for. Five seconds now beats explaining a drained wallet later.

Sources: ThreatMon forensic analysis, Azat analysis of the EIP-7702 exploit, OER Live timeline, MEXC EIP-7702 safety explainer, BlokWiki EIP-7702 safety guide.