#BinanceIncidentReport
A Binance withdrawal freeze could not revoke an on-chain permission that was still moving funds.
The key detail in Binance’s November 3 initial report is not the $6.34B impact: attackers used EIP-7702 to delegate execution rights from a Binance hot wallet to an attacker-controlled contract. Binance says this happened through its internal signing service, outside the normal withdrawal path.
That distinction matters. A normal withdrawal pause blocks the exchange’s ordinary transfer workflow. But EIP-7702 writes a delegation indicator into an account’s on-chain code, and Ethereum’s specification makes that delegation persistent until it is explicitly cleared. Shutting down the wallet service therefore does not, by itself, remove authority already recorded on-chain.
Binance says it needed additional transactions to revoke those permissions. The hot wallet used multi-party computation (MPC), so there was no single private key available for an immediate reversal; a specialized revocation procedure was required. The report records the final unauthorized transfer at 23:56 UTC on October 29, with the Binance14 delegation cleared at 00:10 UTC on October 30.
This does not mean EIP-7702 is inherently unsafe; the standard enables useful account functionality. The overlooked issue is operational: once powerful authorization is committed on-chain, incident response must include revocation at the protocol layer—not only disabling internal services.
The unresolved test for Binance’s independent review is whether its signing policies can prevent unauthorized delegation and whether the MPC revocation path can be executed quickly under pressure.
A Binance withdrawal freeze could not revoke an on-chain permission that was still moving funds.
The key detail in Binance’s November 3 initial report is not the $6.34B impact: attackers used EIP-7702 to delegate execution rights from a Binance hot wallet to an attacker-controlled contract. Binance says this happened through its internal signing service, outside the normal withdrawal path.
That distinction matters. A normal withdrawal pause blocks the exchange’s ordinary transfer workflow. But EIP-7702 writes a delegation indicator into an account’s on-chain code, and Ethereum’s specification makes that delegation persistent until it is explicitly cleared. Shutting down the wallet service therefore does not, by itself, remove authority already recorded on-chain.
Binance says it needed additional transactions to revoke those permissions. The hot wallet used multi-party computation (MPC), so there was no single private key available for an immediate reversal; a specialized revocation procedure was required. The report records the final unauthorized transfer at 23:56 UTC on October 29, with the Binance14 delegation cleared at 00:10 UTC on October 30.
This does not mean EIP-7702 is inherently unsafe; the standard enables useful account functionality. The overlooked issue is operational: once powerful authorization is committed on-chain, incident response must include revocation at the protocol layer—not only disabling internal services.
The unresolved test for Binance’s independent review is whether its signing policies can prevent unauthorized delegation and whether the MPC revocation path can be executed quickly under pressure.
