A $15 fee moved $2.5 billion 🦖
At around 20:20 UTC on October 29, a hacker used a transaction with a fee of about $15 to grant a proxy authorization to a Binance hot wallet on Ethereum
📢 ⏰ 消息群里第一时间说
Three and a half minutes later, that same authorization transferred about $2.5 billion in one go—40% of the $6.3 billion stolen in the heist
What really sends a chill down your spine comes next
By the time the funds were transferred, the platform had already detected the breach and disabled withdrawals
But there was nothing it could do on-chain 💥
Bloomberg’s postmortem lays out what happened
The target was Binance’s hot wallet, code-named Binance 14. Think of it as an online cash register: it routinely held large amounts of Ether, stablecoins, and dozens of other tokens
If the hacker transferred the funds one transaction at a time, each one could have been blocked by risk controls, so they took a shortcut
That shortcut was EIP-7702, which went live in May 2025
It was designed to make wallets easier to use, allowing them to authorize a piece of code to act on their behalf and bundle multiple actions into a single execution
On-chain analysis by security firm Blockaid shows that the hacker first spent about $15 to authorize this code to act for the wallet
That transaction itself didn’t move any funds. It simply told Ethereum that the code could carry out the wallet’s actions from then on
Once the authorization took effect, the sweep took just one transaction
167,464 Ether, plus more than 60 other tokens, the largest chunk of which was $1.6 billion in USDT
Blockchain intelligence firm Elliptic estimates that the same authorization was later reused repeatedly, transferring a total of about $3.6 billion—including another $823 million and four additional sweeps ⚠️
The deadly flaw was that this authorization was recorded on-chain, not on the platform’s servers
Disabling withdrawals or shutting down the hot wallet couldn’t revoke it, while the deposit channel kept sending funds to that address—effectively replenishing the attacker’s ammunition
A Binance spokesperson confirmed to Bloomberg that EIP-7702 played a significant role in the incident. The spokesperson said the affected delegated authorizations had been revoked, the affected wallet infrastructure rebuilt, and signing and monitoring mechanisms updated. User funds are safe, and the platform will bear the losses itself
My take is that this attack never touched the private keys
What was stolen wasn’t a password, but the boundaries of authorization
As wallets become more like banking apps, the permissions a single click can grant keep growing. Users can’t see that line of code—or whether it has been revoked 🔑
We used to worry about our seed phrases being exposed
Now we need to worry about what we’ve signed
For everyday users, it’s worth regularly checking your wallet’s authorization records and revoking delegations you no longer use, especially those for DApps you interacted with just once
Let’s talk in the comments: when was the last time you checked your wallet authorizations?
Every day, we bring you the latest in crypto security and regulatory developments—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀
Tap the profile picture to watch the livestream
At around 20:20 UTC on October 29, a hacker used a transaction with a fee of about $15 to grant a proxy authorization to a Binance hot wallet on Ethereum
📢 ⏰ 消息群里第一时间说
Three and a half minutes later, that same authorization transferred about $2.5 billion in one go—40% of the $6.3 billion stolen in the heist
What really sends a chill down your spine comes next
By the time the funds were transferred, the platform had already detected the breach and disabled withdrawals
But there was nothing it could do on-chain 💥
Bloomberg’s postmortem lays out what happened
The target was Binance’s hot wallet, code-named Binance 14. Think of it as an online cash register: it routinely held large amounts of Ether, stablecoins, and dozens of other tokens
If the hacker transferred the funds one transaction at a time, each one could have been blocked by risk controls, so they took a shortcut
That shortcut was EIP-7702, which went live in May 2025
It was designed to make wallets easier to use, allowing them to authorize a piece of code to act on their behalf and bundle multiple actions into a single execution
On-chain analysis by security firm Blockaid shows that the hacker first spent about $15 to authorize this code to act for the wallet
That transaction itself didn’t move any funds. It simply told Ethereum that the code could carry out the wallet’s actions from then on
Once the authorization took effect, the sweep took just one transaction
167,464 Ether, plus more than 60 other tokens, the largest chunk of which was $1.6 billion in USDT
Blockchain intelligence firm Elliptic estimates that the same authorization was later reused repeatedly, transferring a total of about $3.6 billion—including another $823 million and four additional sweeps ⚠️
The deadly flaw was that this authorization was recorded on-chain, not on the platform’s servers
Disabling withdrawals or shutting down the hot wallet couldn’t revoke it, while the deposit channel kept sending funds to that address—effectively replenishing the attacker’s ammunition
A Binance spokesperson confirmed to Bloomberg that EIP-7702 played a significant role in the incident. The spokesperson said the affected delegated authorizations had been revoked, the affected wallet infrastructure rebuilt, and signing and monitoring mechanisms updated. User funds are safe, and the platform will bear the losses itself
My take is that this attack never touched the private keys
What was stolen wasn’t a password, but the boundaries of authorization
As wallets become more like banking apps, the permissions a single click can grant keep growing. Users can’t see that line of code—or whether it has been revoked 🔑
We used to worry about our seed phrases being exposed
Now we need to worry about what we’ve signed
For everyday users, it’s worth regularly checking your wallet’s authorization records and revoking delegations you no longer use, especially those for DApps you interacted with just once
Let’s talk in the comments: when was the last time you checked your wallet authorizations?
Every day, we bring you the latest in crypto security and regulatory developments—not just what’s happening, but the logic and opportunities behind the headlines 👀🚀
Tap the profile picture to watch the livestream
