This wasn't simply someone finding a bug in Ethereum.
The attack exposed a much bigger problem: how an attacker could exploit the exchange's internal signing infrastructure.
Here's what we know so far. 👇
1️⃣ Ethereum wasn't the vulnerability
The attacker exploited EIP-7702, a feature introduced through Ethereum's Pectra upgrade.
It allows regular wallets to delegate execution to smart contract code, but requires authorization signed by the wallet's own key.
The feature worked as designed. The real question is how the attacker obtained valid authorization.
2️⃣ The 50-signature strategy
According to Blockaid, the attacker submitted 50 pre-signed authorizations covering consecutive nonces for Binance 14.
Only one needed to match the wallet's live nonce.
That authorization allowed the attacker's contract to take control of the wallet's execution.
3️⃣ The massive fund movement
The first major Ethereum transaction moved approximately:
• 167,464 ETH
• $1.615 billion in USDT
• More than 60 additional tokens
Other Binance hot wallets across multiple networks were also affected.
4️⃣ Billions were frozen
Tether, Circle and other blockchain participants moved quickly to restrict access to affected funds.
Binance's latest official update says approximately $3 billion has been frozen on-chain.
5️⃣ The biggest unanswered question
How did the attacker gain access to the signing process?
Binance's October 30 update says its initial investigation points to a potentially compromised DevOps engineer's laptop, which may have enabled access to a service container and unauthorized withdrawal submissions.
Binance says there is currently no evidence of a wallet private-key leak.
6️⃣ Binance's official response
Binance estimates the total impact at approximately $6.3 billion and says it will cover all losses using SAFU and company funds.
It also says customer funds are safe and that withdrawals and deposits were temporarily suspended as a precaution.
⚠️ THE BIGGER LESSON
Crypto security isn't just about protecting private keys.
Internal systems, authorization processes, employee devices and operational controls matter just as much.
Don't confuse an Ethereum feature working as designed with an exchange's security being compromised.
Stay informed. Verify official updates. Don't panic or spread unconfirmed numbers.
❤️ In crypto, facts matter more than fear.