securityresearch

50 SIGNATURES. 24 SECONDS.

$2.7 billion left Binance 14 in 24 seconds.

The attacker didn't steal a private key. They bundled 50 EIP-7702 authorizations into one transaction. Each signature handed wallet control to the same smart contract. Once all 50 were in, the hot wallet drained.

This is the first major exploit using EIP-7702 at this scale. The standard lets an externally owned account delegate to a smart contract. Useful for account abstraction. Catastrophic when the signing process is compromised.

Binance says the laptop was the entry point. But the signature bundling was the weapon.

$BNB

#EIP7702 #SmartContracts #BinanceHack #SecurityResearch #OnChainAnalysis