The Binance hackers paid only about $15 to drain $2.5 billion in a single transaction—and it wasn’t because Ethereum had been breached.
The facts: Bloomberg (Nov. 6, citing Blockaid’s analysis) detailed how it worked. On Oct. 29 at around 20:20 UTC, the hackers used a valid signature from Binance Hot Wallet 14 to delegate control of the wallet to their code via EIP-7702—a feature in the May 2025 Pectra upgrade that lets wallets authorize smart contracts. Setting up that authorization cost about $15. Three minutes and 24 seconds later, a single transaction swept up 167,464 ETH, about $1.615 billion in USDT, and roughly 60 other tokens—a total of about $2.5 billion. According to Elliptic, about $3.6 billion in total was moved through the same delegation. Because the authorization existed on the blockchain, shutting down Binance’s hot wallet service didn’t revoke it—the delegation was only revoked at 00:10 UTC on Oct. 30. A Binance spokesperson confirmed that EIP-7702 “played a significant role” in the hack. The FBI attributed the attack to the North Korea-linked TraderTraitor group; Pyongyang denied it.
My take: what’s frightening isn’t the amount, but the lesson—that on-chain controls can’t be switched off with an off button. Once a signer’s key is compromised, delegation becomes an express lane. But don’t misread this: according to Blockaid’s CEO, even without EIP-7702, the funds could probably still have been stolen—just more slowly. So this isn’t about one “dangerous” Ethereum feature; it’s about a hot wallet key falling into an attacker’s hands. For everyday users, the message is simple: regularly review approvals and delegations to unfamiliar contracts, and revoke them if they’re no longer needed.
What I’m watching: Binance’s promised full post-mortem, and whether other exchanges start restricting EIP-7702 delegations on their hot wallets.
What do you think is the biggest security lesson for exchanges from this incident—the keys, the delegation, or the detection?
This is my analysis, not financial advice—always DYOR.
#KeamananCrypto #Ethereum $ETH $USDT
The facts: Bloomberg (Nov. 6, citing Blockaid’s analysis) detailed how it worked. On Oct. 29 at around 20:20 UTC, the hackers used a valid signature from Binance Hot Wallet 14 to delegate control of the wallet to their code via EIP-7702—a feature in the May 2025 Pectra upgrade that lets wallets authorize smart contracts. Setting up that authorization cost about $15. Three minutes and 24 seconds later, a single transaction swept up 167,464 ETH, about $1.615 billion in USDT, and roughly 60 other tokens—a total of about $2.5 billion. According to Elliptic, about $3.6 billion in total was moved through the same delegation. Because the authorization existed on the blockchain, shutting down Binance’s hot wallet service didn’t revoke it—the delegation was only revoked at 00:10 UTC on Oct. 30. A Binance spokesperson confirmed that EIP-7702 “played a significant role” in the hack. The FBI attributed the attack to the North Korea-linked TraderTraitor group; Pyongyang denied it.
My take: what’s frightening isn’t the amount, but the lesson—that on-chain controls can’t be switched off with an off button. Once a signer’s key is compromised, delegation becomes an express lane. But don’t misread this: according to Blockaid’s CEO, even without EIP-7702, the funds could probably still have been stolen—just more slowly. So this isn’t about one “dangerous” Ethereum feature; it’s about a hot wallet key falling into an attacker’s hands. For everyday users, the message is simple: regularly review approvals and delegations to unfamiliar contracts, and revoke them if they’re no longer needed.
What I’m watching: Binance’s promised full post-mortem, and whether other exchanges start restricting EIP-7702 delegations on their hot wallets.
What do you think is the biggest security lesson for exchanges from this incident—the keys, the delegation, or the detection?
This is my analysis, not financial advice—always DYOR.
#KeamananCrypto #Ethereum $ETH $USDT