Dan U’s on-chain breakdown lays out the full picture of this Binance hack, with details so precise they’re alarming:
1. Four hours before the actual attack, the attacker rehearsed with 2.54 USDT. Using the same EOA, the same sweep() function, and the full toolkit, they ran the entire attack process on a small wallet first, confirmed there were no bugs, and then went after Binance’s hot wallet #14.
2. Timeline: At 20:20:59, an EIP-7702 delegation was attached to the wallet. The attacker waited a full three and a half minutes before starting to move the assets.
In fact, monitoring eth_getCode could have caught this anomaly long beforehand, but nobody was watching.
3. The key point: this wasn’t a single signature, but a carpet of signatures covering 50 consecutive nonces.
The Binance hot wallet’s private key had signed 50 authorizations in advance. The attacker broadcast them in batches, betting that one of the nonces would match the wallet’s current state. The private key itself didn’t directly send any transactions; it only signed this batch of authorizations.
4. A highly dramatic twist: Binance inadvertently defused the bomb.
The attacker’s 50 signatures could have been reused repeatedly. But Binance’s withdrawal bot automatically processed 44 ordinary transactions, burning through the subsequent nonces and invalidating all the remaining authorizations that hadn’t matched. Binance had no idea this trap was there at the time, but accidentally eliminated the attacker’s fallback plan.
5. The risk isn’t over: this wallet is still a live trap.
The malicious delegation is still attached to the wallet address, and the malicious code can be found with eth_getCode.
New user deposits are still flowing into this wallet. At the time, it held about $1.1 million, which could theoretically be swept again at any moment.
The entire attack design, the advance rehearsal, the nonce carpet, Binance accidentally eliminating the attacker’s fallback plan—and the wallet still being left with a time bomb.
This was far more than a simple crypto theft; it was a textbook EIP-7702 attack.$BTC $ETH $LINK
1. Four hours before the actual attack, the attacker rehearsed with 2.54 USDT. Using the same EOA, the same sweep() function, and the full toolkit, they ran the entire attack process on a small wallet first, confirmed there were no bugs, and then went after Binance’s hot wallet #14.
2. Timeline: At 20:20:59, an EIP-7702 delegation was attached to the wallet. The attacker waited a full three and a half minutes before starting to move the assets.
In fact, monitoring eth_getCode could have caught this anomaly long beforehand, but nobody was watching.
3. The key point: this wasn’t a single signature, but a carpet of signatures covering 50 consecutive nonces.
The Binance hot wallet’s private key had signed 50 authorizations in advance. The attacker broadcast them in batches, betting that one of the nonces would match the wallet’s current state. The private key itself didn’t directly send any transactions; it only signed this batch of authorizations.
4. A highly dramatic twist: Binance inadvertently defused the bomb.
The attacker’s 50 signatures could have been reused repeatedly. But Binance’s withdrawal bot automatically processed 44 ordinary transactions, burning through the subsequent nonces and invalidating all the remaining authorizations that hadn’t matched. Binance had no idea this trap was there at the time, but accidentally eliminated the attacker’s fallback plan.
5. The risk isn’t over: this wallet is still a live trap.
The malicious delegation is still attached to the wallet address, and the malicious code can be found with eth_getCode.
New user deposits are still flowing into this wallet. At the time, it held about $1.1 million, which could theoretically be swept again at any moment.
The entire attack design, the advance rehearsal, the nonce carpet, Binance accidentally eliminating the attacker’s fallback plan—and the wallet still being left with a time bomb.
This was far more than a simple crypto theft; it was a textbook EIP-7702 attack.$BTC $ETH $LINK