Hacker exploited Ethereum’s EIP-7702 mechanism in the Binance hack
The attacker in the Binance security incident took advantage of the EIP-7702 feature introduced in Ethereum’s Pectra upgrade, draining $2.5 billion in less than 4 minutes:
• Turned exchange wallets into fund-draining contracts: EIP-7702 allows regular wallets to borrow smart contract execution code through a brief authorization signature. The attacker deployed a malicious contract and turned Binance’s large wallet 14 into a tool for running this code and taking full control of its assets.
• Prepared 50 signatures to anticipate transaction nonces: Because Binance’s hot wallet was constantly processing orders, causing its nonce to change every second, the hacker collected 50 valid signatures in advance, covering the range from 18.914.775 to 18.914.824. This ensured that the takeover transaction would execute as soon as the next nonce became available.
• Drained $2.5 billion and took control of linked wallets: The hacker transferred 167,464 ETH and 1.6 billion USDT in a single transaction, while also using the authorization to instruct another hot wallet to withdraw a further 823 million USDC and continuously drain users’ newly deposited funds for nearly 4 hours before Binance could revoke the authorization.
So this is why it took Binance so long to trace and stop the hack. The more convenience technology brings to users, the greater the security risks.
This time, Binance and other exchanges will have to overhaul their wallet systems, or Ethereum will need another upgrade.
The attacker in the Binance security incident took advantage of the EIP-7702 feature introduced in Ethereum’s Pectra upgrade, draining $2.5 billion in less than 4 minutes:
• Turned exchange wallets into fund-draining contracts: EIP-7702 allows regular wallets to borrow smart contract execution code through a brief authorization signature. The attacker deployed a malicious contract and turned Binance’s large wallet 14 into a tool for running this code and taking full control of its assets.
• Prepared 50 signatures to anticipate transaction nonces: Because Binance’s hot wallet was constantly processing orders, causing its nonce to change every second, the hacker collected 50 valid signatures in advance, covering the range from 18.914.775 to 18.914.824. This ensured that the takeover transaction would execute as soon as the next nonce became available.
• Drained $2.5 billion and took control of linked wallets: The hacker transferred 167,464 ETH and 1.6 billion USDT in a single transaction, while also using the authorization to instruct another hot wallet to withdraw a further 823 million USDC and continuously drain users’ newly deposited funds for nearly 4 hours before Binance could revoke the authorization.
So this is why it took Binance so long to trace and stop the hack. The more convenience technology brings to users, the greater the security risks.
This time, Binance and other exchanges will have to overhaul their wallet systems, or Ethereum will need another upgrade.
