An attacker exploited a previously little-known Ethereum protocol feature, EIP-7702, to steal approximately $6.4 billion from one of Binance’s hot wallets on October 29, 2026. Analysts from Chainalysis and TRM Labs confirmed the unprecedented scale of the theft, making it the largest recorded loss in cryptocurrency history. Binance, the world’s leading crypto exchange by trading volume, announced it would cover user losses, setting aside $6.34 billion in company funds.
How EIP-7702 came into play
EIP-7702, known as “Set Code for EOAs,” was activated with Ethereum’s Pectra upgrade on May 7, 2025. The specification was written in May 2024 by Ethereum creator Vitalik Buterin along with Sam Wilson, Ansgar Dietrichs, and lightclient. EIP-7702 allows a standard Ethereum wallet, formally called an Externally Owned Account (EOA), to temporarily point to a smart contract. This capability enables wallets to “borrow” smart contract code, greatly expanding their functionality but also introducing new security risks.
Each delegation requires signing with the private key of the wallet, preventing unauthorized external changes unless the attacker has key access. According to the specification, this feature aimed to let users batch actions, allow applications to cover transaction fees, and permit the creation of limited-permission sub-keys.
EIP-7702 was designed to give regular wallets smart contract powers, letting users approve code delegation with their signature. However, its inventors warned that delegated code would have “unrestricted access to the account,” and advised wallet developers not to expose this interface directly to users.
Mini dictionary: EIP-7702 is an Ethereum protocol update that lets a regular wallet temporarily delegate to smart contract code, providing added flexibility but also increasing the risk in cases of compromised keys.
Timeline and technique of the Binance hack
Investigators traced the breach to October 29, 2026, when funds began moving out of Binance wallets on multiple blockchains. Around 20:21 UTC, the attacker sent a batch of 50 authorization transactions tied to EIP-7702 targeting Binance 14, one of the exchange’s hot wallets. Only one transaction succeeded, repointing that wallet to a malicious contract and granting the attacker full control over its assets.
Chainalysis and TRM Labs reported that roughly $6.36 billion was stolen across ten blockchains within about 20 minutes. However, CCN found that about $3.66 billion of the funds were drained through traditional transfers not involving EIP-7702, suggesting that the root problem centered on access to the wallet’s signing keys rather than a protocol flaw.
| Organization | Estimated Theft Amount (USD) |
|---|---|
| Chainalysis | $6.3 billion – $6.4 billion |
| TRM Labs | $6.36 billion |
| CCN (without EIP-7702) | $3.66 billion |
Investigators from Blockaid detailed that the single successful EIP-7702 authorization shifted Binance 14 to a malicious contract, draining funds including over 167,000 ETH and more than 1.6 billion USDT. The theft was attributed to North Korea’s TraderTraitor, a hacking group previously tied by the FBI to similar attacks on cryptocurrency exchanges, including Bybit’s $1.5 billion loss in February 2025.
Binance’s internal update indicated that attackers may have gained access through a DevOps engineer’s compromised laptop, which allowed them to sign malicious authorizations and standard transfers alike.
Investigators suspect that the entry point was an engineer’s device, which allowed the attacker to access a service container and initiate unauthorized withdrawals, using both EIP-7702 authorizations and ordinary key-signed transactions.
Aftermath and immediate impact on markets
Blockchain analysis firms identified rapid asset movement and freezing responses. Tether froze nearly $1.57 billion in USDT, while Circle locked more than $800 million in USDC. Binance reported a total of $3 billion frozen on-chain, limiting the amount accessible to the hacker.
The Binance hack caused sharp drops in major crypto prices: on October 30, Bitcoin traded at $77,525, down 4.76% over 24 hours, while Ethereum fell to $2,248.91, a 4.71% loss. Within a week, both coins were down more than 5%, and Binance’s own BNB token dropped 6.39% to $703.07. The Crypto Fear & Greed Index measured market sentiment at 30, indicating a level of fear among investors.
| Asset | Price (USD) | 24h change | 7d change |
|---|---|---|---|
| Bitcoin (BTC) | $77,525 | -4.76% | -5.9% |
| Ethereum (ETH) | $2,248.91 | -4.71% | -7.37% |
| BNB | $703.07 | -6.39% | -6.68% |
Next steps and open questions
Binance CEO Yi He stated that customer withdrawals had been temporarily suspended but were expected to resume by Sunday. With 335 million registered users, the exchange’s ability to promptly restore services is under close scrutiny.
The main security concern for the crypto sector is whether wallet providers and custodians will reinforce controls around EIP-7702 authorizations. Although EIP-7702 itself does not allow access without the private key, the incident has highlighted the growing risks associated with flexible smart contract features when private key security is breached.
Both TRM Labs and Chainalysis continue to monitor laundering routes for the stolen funds, with ongoing asset freezes and future changes to the quantified loss figure remaining possible. The broader impact of enhanced smart wallet features on exchange security also remains a key topic for the Ethereum community.
