According to analysis by blockchain security firm Blockaid, the attacker used Ethereum’s EIP-7702 authorization mechanism to attack Binance’s Binance 14 hot wallet. Because the attacker could not determine the hot wallet’s live nonce, and EIP-7702 authorizations must match the account’s nonce at the time of transaction execution, the attacker submitted 50 authorizations with different nonces (18914775 to 18914824) in a single Type-4 transaction. Only one matched successfully, allowing the malicious delegation to take effect.

The successful authorization delegated the hot wallet’s account code to an unverified malicious asset-transfer contract. The contract allows only the address designated by the attacker to execute the sweep() function, which can transfer ETH and ERC-20 tokens from the wallet while retaining 1 ETH for gas fees. Subsequent incoming assets may also be at risk of being transferred.