How One Signature Emptied a Binance Hot Wallet — the EIP-7702 Trail Behind the $5.8 Billion Drain

The first reports of the Binance incident read like a market story: billions moving, prices falling, stablecoin issuers freezing funds. The on-chain reconstruction published since reads like something else entirely — a security story about a single Ethereum feature, a signed permission, and a wallet that was turned into a sweeper for its own funds. Binance has not confirmed a cause, and the figures below come from on-chain analysts, Etherscan records and security researchers, not from a Binance finding. But the trail they describe is remarkably specific, and it matters far beyond one exchange.

The feature at the centre: EIP-7702. EIP-7702 arrived with Ethereum's Pectra upgrade in May 2025. It lets an ordinary wallet — an externally owned account, the kind most people use — sign an authorisation that hands control of that wallet to a piece of smart-contract code. The wallet then runs the contract's code as itself. It is a convenience feature for account abstraction: a normal wallet can temporarily behave like a smart contract. It also means that a single valid signature can convert a wallet into something its owner never intended — a sweeper that forwards everything it receives to someone else's address. That, according to security firm Blockaid and multiple on-chain reconstructions, is what happened to a Binance hot wallet labelled "Binance 14".

The timeline, minute by minute. The setup began a day early. On October 28, the attacker's address received small amounts of ETH — about 0.1 ETH — through Tornado Cash, a mixer that obscures where funds come from, with further small deposits on October 29. At 15:59:11 UTC on October 29, that address created a small smart-contract — the sweeper — whose source code is not verified on Etherscan. Then came the decisive step. At 20:20:59 UTC, a transaction linked Binance 14 to the attacker's contract through EIP-7702. A delegation needs an authorisation signed by the key of Binance 14 itself, and how the attacker obtained that signature is still not known. Blockaid's account of the trick is striking: the attacker apparently did not know the wallet's exact nonce, so they bundled 50 EIP-7702 authorisations into a single transaction, and one of them matched. About three minutes later, at 20:24:23 UTC, Binance 14 sent out 167,464.25 ETH plus 63 other tokens — including roughly 1.6 billion USDT — in a single transaction worth around $2.5 billion. More followed: 28,005.6 ETH from a wallet labelled Binance 16, and about 195,460 ETH (around $442 million) to a second address roughly 15 minutes later. From another hot wallet, 780 million USDC left at 20:41 UTC and a further 43 million USDC at 20:59 UTC — 823 million USDC in total. On-chain trackers put the gross outflows as high as $5.8 billion, with about $3.3 billion moving in roughly 40 minutes, though those headline figures reflect wallet holdings and outflows, not a confirmed net loss.

The freeze — and what it could not stop. Because so much of the loot was in stablecoins, the issuers could act, and they did. Around 21:15–21:25 UTC, Tether froze more than $1.567 billion in USDT tied to the incident, and Circle froze around $823 million in USDC; Ripple and World Liberty Financial also froze stablecoins, taking the frozen total above $2.36 billion. Aave froze lending markets so the attacker could not borrow against the stolen funds. But the freeze has a hard limit: it only works on assets whose issuers can freeze them. Bitcoin and ether cannot be frozen, and one analysis noted the attacker holding 18,270 BTC that no issuer can stop. That split is why the estimates diverge so sharply: gross outflows up to $5.8 billion, a Wall Street Journal figure of at least $1.7 billion, and a net loss estimate of around $1 billion once frozen stablecoins are excluded. Binance founder Changpeng Zhao responded to an analysis by DeFiLlama founder 0xngmi confirming that losses may be slightly higher than $1 billion — and that Binance will bear the full amount. Against roughly $144 billion in assets under custody, that net loss is about 0.69%.

The reserves question: Binance 14 was a proof-of-reserves wallet. The most consequential detail arrived on October 30, from CoinDesk's review of Binance's own reserve data. The wallets emptied in the attack are the same wallets Binance lists as proof that customers' crypto is fully backed. Every month, Binance publishes the wallets it controls and compares their totals with what customers hold. Its most recent report, dated October 1, includes Binance 14, which then held 1.26 billion USDT and 89,475 ETH among 37 assets. On October 1, Binance held exactly enough ETH to cover customer balances — a 100% reserve ratio — and 108.26% of customers' USDC. The roughly 204,500 ETH taken represents approximately 5.6% of Binance's ETH reserves, leaving ether backing near 94% until the exchange replaces what was taken. Smaller positions, including ENA, UNI, PEPE and AAVE, represent anywhere from 7% to 15% of Binance's reported holdings of each. Binance says user funds are safe, and its November 1 reserve snapshot will show whether it has replaced the missing assets. Until that snapshot lands, the safety of customer funds rests substantially on Binance's word — and on Zhao's commitment to absorb the loss in full.

What it means for crypto investors. Three takeaways follow. First, EIP-7702 changes the threat model for every ordinary wallet, not just exchanges: a single delegated signature can turn a wallet into a sweeper, so signing permissions deserve the same suspicion as handing over a private key — and Blockaid's chief executive described this incident as signing misuse rather than key theft, drawing a parallel with the February 2025 Bybit attack, previously the largest confirmed crypto heist at $1.5 billion. Second, exchange security is now partly a key-management story: how an outside address obtained a valid Binance 14 signature remains the central unanswered question, and Blockaid noted similarities with campaigns typically associated with North Korean cyber operations — an observed similarity, not a confirmed attribution. Third, watch the November 1 proof-of-reserves snapshot, not the headlines: it is the first hard evidence of whether Binance has made its ether backing whole again, and whether the "user funds are safe" assurance survives contact with its own published numbers.

FAQ. What is EIP-7702? An Ethereum feature from the May 2025 Pectra upgrade that lets an ordinary wallet sign an authorisation to run smart-contract code as itself. How was Binance 14 drained? Per on-chain reconstructions, an EIP-7702 delegation at 20:20:59 UTC on October 29 linked the wallet to an attacker-deployed sweeper contract; at 20:24:23 UTC it sent 167,464.25 ETH plus 63 tokens, including about 1.6 billion USDT, in one transaction. How did the attacker get the signature? Unknown. Blockaid reports 50 authorisations were bundled into one transaction because the wallet's exact nonce was not known, and one matched. How much was actually lost? Gross outflows are estimated up to $5.8 billion; after stablecoin freezes above $2.36 billion, the net loss is estimated slightly above $1 billion, which Zhao says Binance will bear in full. Are customer funds safe? Binance says so. CoinDesk's reserve analysis puts ether backing near 94% (from 100% on October 1) until assets are replaced; the November 1 snapshot is the test. Has Binance confirmed the mechanism? No — Binance says it is investigating a potential security issue and has not confirmed a cause.

For more market news and discussion, follow Zimbuck News at https://zimbuck.com/pages/zimbucknews and join the Zimbuck Market News group at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: https://zimbuck.com/blogs/401/Binance-Hit-by-Suspected-2-5-Billion-Wallet-Drain-What

This article is market news and general information only, not financial advice.