The Truth Behind Binance’s $5.6 Billion Theft! How Did Signing Authority Become Execution Authority?
Binance’s hot wallet was hacked, and approximately $5.64 billion in assets was stolen. The attacker exploited the EIP-7702 feature to transfer funds from hot wallets on Ethereum, Bitcoin, Tron, and multiple L2 networks. Afterward, Tether, Circle, Ripple, and World Liberty Financial coordinated to freeze approximately $3 billion of the stolen assets, accounting for 45% of the total outflow.
EIP-7702 itself is not a traditional vulnerability; it is an official feature introduced with Ethereum’s 2025 Pectra upgrade. It allows an externally owned account (EOA) to delegate its code execution authority to a designated smart contract with a single signature. Once the delegation takes effect, any call to that wallet executes the delegated contract’s logic while using the wallet’s own balance and storage. Signing authority is thus upgraded directly into code execution authority.
The full attack unfolded roughly as follows:
The attacker first obtained valid signing authority for Binance’s hot wallet. They then deployed a sweeping contract in advance, designed to accept calls only from a specific address and transfer all assets out of the wallet. Because the hot wallet was continually sending transactions and its nonce kept changing, the attacker got the wallet to sign multiple EIP-7702 authorizations covering different nonces. The attacker then submitted transactions containing those authorizations from their own address. One of them matched, and the delegation was officially recorded on-chain. Within minutes, the attacker called the sweeping contract and transferred large amounts of ETH and various tokens in a single operation. Similar patterns also appeared in hot wallets on other chains.
From the blockchain’s perspective, the entire process consisted of completely legitimate transactions; no smart contract vulnerability was triggered. The problem was that signing authority had been compromised, and EIP-7702 amplified the consequences of that authority to the extreme.
The incident is another reminder that when hot wallets and online signing systems are compromised, new features can become tools for accelerating asset loss. For ordinary users, large holdings should still preferably be kept in cold wallets or protected by multisignature schemes, and any authorization operation should be treated with extreme caution.#币安热门推荐 $BNB
Binance’s hot wallet was hacked, and approximately $5.64 billion in assets was stolen. The attacker exploited the EIP-7702 feature to transfer funds from hot wallets on Ethereum, Bitcoin, Tron, and multiple L2 networks. Afterward, Tether, Circle, Ripple, and World Liberty Financial coordinated to freeze approximately $3 billion of the stolen assets, accounting for 45% of the total outflow.
EIP-7702 itself is not a traditional vulnerability; it is an official feature introduced with Ethereum’s 2025 Pectra upgrade. It allows an externally owned account (EOA) to delegate its code execution authority to a designated smart contract with a single signature. Once the delegation takes effect, any call to that wallet executes the delegated contract’s logic while using the wallet’s own balance and storage. Signing authority is thus upgraded directly into code execution authority.
The full attack unfolded roughly as follows:
The attacker first obtained valid signing authority for Binance’s hot wallet. They then deployed a sweeping contract in advance, designed to accept calls only from a specific address and transfer all assets out of the wallet. Because the hot wallet was continually sending transactions and its nonce kept changing, the attacker got the wallet to sign multiple EIP-7702 authorizations covering different nonces. The attacker then submitted transactions containing those authorizations from their own address. One of them matched, and the delegation was officially recorded on-chain. Within minutes, the attacker called the sweeping contract and transferred large amounts of ETH and various tokens in a single operation. Similar patterns also appeared in hot wallets on other chains.
From the blockchain’s perspective, the entire process consisted of completely legitimate transactions; no smart contract vulnerability was triggered. The problem was that signing authority had been compromised, and EIP-7702 amplified the consequences of that authority to the extreme.
The incident is another reminder that when hot wallets and online signing systems are compromised, new features can become tools for accelerating asset loss. For ordinary users, large holdings should still preferably be kept in cold wallets or protected by multisignature schemes, and any authorization operation should be treated with extreme caution.#币安热门推荐 $BNB
