Charles Hoskinson, founder of Cardano, issued a caution to the crypto community after analyzing a recent incident where a Binance wallet suffered a major breach. In his X post, Hoskinson highlighted the presence of highly dangerous code in the attack, as detailed by a researcher known as CyberSatoshi. The analysis suggests that the exploit may be linked to Ethereum’s EIP-7702 delegation feature, although Binance has not confirmed this connection nor disclosed precisely how the attackers gained signing authority.
Binance wallet exploit and asset transfer mechanism
CyberSatoshi shared a technical breakdown claiming that the malicious contract involved was crafted to rapidly drain a heavily used exchange hot wallet. According to the researcher, the contract executed a function that systematically swept balance while intentionally leaving one ETH behind to ensure the transaction would not fail due to insufficient gas fees.
The attack reportedly involved a wallet holding approximately $823 million in USDC tokens. This wallet recognized Binance’s hot wallet “Binance 14” as an authorized controller, allegedly allowing the exploit to move funds despite being on a restricted list. Blockchain specialists note, however, that the full impact and the exact method the hacker used to gain authorization remain unclear and unverified.
According to the company, the wider breach on October 29 resulted in $6.3 billion in damages. On October 30, Binance stated it had found no indications that any private keys had been stolen or leaked.
Careful, there is some seriously dangerous code out there. This incident emphasizes the risks associated with smart contract delegation features.
Mini dictionary: EIP-7702 – A proposed Ethereum protocol improvement that enables accounts to delegate execution by allowing their code to be temporarily replaced, supporting batch transactions and payment of fees by third parties.
Delegation features and security loopholes
EIP-7702, an Ethereum protocol proposal, allows accounts to delegate operational code to another address during transactions. This feature includes mechanisms for batch processing and allows another party to cover transaction fees. The delegation permissions require several data points, such as the blockchain identifier, delegate address, nonce, and the digital signature. Once validated, code can be assigned to the account for limited periods.
CyberSatoshi’s analysis emphasized that the ultimate success of such an exploit depends on having legitimate signing rights. Either a leaked private key or access to unrestricted authorization would be necessary. Binance has publicly denied finding any evidence of private key exposure in this case.
Further examination found a series of 50 digital signatures, each corresponding to consecutive transaction nonces for Binance 14. In blockchain parlance, a nonce is a unique value incremented for each transaction. The exploit involved generating authorizations that matched valid current nonces, which enabled swift delegation and transfer of funds before mitigation was possible.
| Wallet | Reported Role | Asset Involved | Value |
|---|---|---|---|
| Binance 14 | Hot wallet, target of delegation | USDC, ETH | $823 million (USDC), 1 ETH left |
Researchers detected that, when processed in sequence, multiple authorizations could succeed as long as the nonce matched the expected value for each respective transaction. Blockchain records showed that the most recent successful nonce enabled the transfer of large amounts in a single operation.
Response and ongoing investigation
Due to the rapidity of the exploit, Binance had minimal time to detect or interrupt the transfers. CyberSatoshi questioned whether earlier identification of normal transactions would have allowed for faster detection, but noted that such early warning systems may not always be effective.
Ethereum’s technical documentation warns of the inherent risk associated with delegation, as it can provide attackers with persistent control unless explicit constraints are enforced. Experts recommend wallet developers to audit delegation contracts rigorously to prevent replay or batch attack scenarios.
Although it is possible to revoke delegated permissions using the “zero address,” the risk remains that authorization, once exploited, does not automatically disappear. Binance actioned the immediate revocation of affected authorizations and tightened security protocols in the aftermath of the breach.
The exchange assured its users that all customer losses would be covered and pledged to release a full technical report. Nevertheless, questions regarding how access controls were bypassed are still open and the investigation continues.
CyberSatoshi highlighted the speed of the attack and raised doubts about the effectiveness of early transaction monitoring. The exchange is now focused on strengthening its security measures and clarifying the events that led to the incident.
