The Binance hack has exposed how an attacker used a single successful Ethereum wallet authorization to gain control of a major exchange wallet, as Binance estimates that the October 29 security breach affected approximately $6.3 billion in cryptocurrency.
Summary
- Binance estimates the October 29 security incident affected roughly $6.3 billion in cryptocurrency.
- Blockaid traced the attack to 50 EIP-7702 authorizations, with one successfully targeting the Binance 14 hot wallet.
- Binance’s initial investigation points to a compromised DevOps engineer’s laptop, but the exchange found no evidence of a leaked private key.
- Tether and Circle froze more than $2.3 billion in stablecoins linked to the attack, while Binance reported approximately $3 billion frozen across assets.
- Binance suspended deposits and withdrawals during security checks and pledged to cover losses through its SAFU fund and company reserves.
According to blockchain security firm Blockaid, the attacker exploited Ethereum’s EIP-7702 authorization mechanism to redirect Binance’s heavily used Binance 14 hot wallet to a malicious smart contract. The attacker submitted 50 authorizations in one transaction, but only one matched the wallet’s transaction counter and successfully activated the contract.
Binance’s October 30 security update identified a potentially compromised DevOps engineer’s laptop as the initial entry point. The exchange said approximately $3 billion in affected assets had been frozen and pledged to cover customer losses.
Binance hack used 50 authorizations to take control of hot wallet
Blockaid’s investigation identified an Ethereum transaction submitted at 20:20:59 UTC on October 29, containing 50 EIP-7702 authorizations targeting Binance 14.
EIP-7702 allows an ordinary Ethereum wallet to delegate transaction execution to smart contract code. Each authorization must match the wallet’s current nonce, a transaction counter that changes as the account processes transactions.
Because Binance 14 was actively handling withdrawals, the attacker could not reliably predict its nonce. The submitted authorizations covered consecutive values between 18,914,775 and 18,914,824, increasing the chance that one would match when Ethereum processed the transaction.
Only one authorization succeeded. It directed the wallet to an unverified contract that permitted an attacker-controlled address to execute a function called sweep(), transferring ETH and ERC-20 tokens while retaining 1 ETH for transaction fees.
The malicious delegation could have exposed subsequent deposits until Binance removed it. The exchange later confirmed that it had revoked the affected authorization.
Previous EIP-7702 wallet attacks had demonstrated similar risks, including an October 14 incident in which a compromised Ethereum account lost approximately $22,770 in ETH.
Binance says compromised laptop may have enabled unauthorized withdrawals
Binance’s preliminary investigation identified a possible compromise of a DevOps engineer’s laptop, which may have given the attacker access to an internal service container used to submit withdrawal transactions.
The exchange said investigators had found no evidence that any wallet private key had leaked, although they had not established precisely how the attacker obtained the authorizations needed to redirect Binance 14.
Blockchain records examined by Blockaid showed preparations beginning before the main theft. The attacker funded an operating address through three Tornado Cash withdrawals and deployed the malicious contract several hours before using it against Binance.
At approximately 20:24 UTC, the attacker drained Binance 14 of cryptocurrency worth roughly $2.5 billion. The transfers included 167,464 ETH, more than 1.6 billion USDT and dozens of other tokens.
Additional transfers involved Binance 16 and another Ethereum hot wallet holding USDC. The operation spread across several blockchain networks, including Bitcoin, Tron, Arbitrum and Avalanche.
Previous research into malicious wallet delegations had identified automated contracts designed to transfer assets from compromised accounts following Ethereum’s Pectra upgrade.
Tether and Circle freeze billions linked to Binance hack
Following the attack, cryptocurrency issuers began restricting access to assets associated with suspicious addresses.
Tether CEO Paolo Ardoino confirmed that the stablecoin issuer had frozen more than 1.567 billion USDT connected to the suspected breach. Circle CEO Jeremy Allaire separately reported freezing more than 800 million USDC while coordinating with law enforcement.
Ripple’s stablecoin executive Jack McDonald said the company was working with relevant parties to freeze affected RLUSD holdings.
Meanwhile, the Arbitrum Security Council reported transferring 74,559,805 ARB and 8,425 ETH from an address linked to the attack into a restricted intermediary wallet. The organization said the assets could only move following further council action or an Arbitrum DAO governance decision.
The coordinated response left approximately $3 billion frozen across affected assets, according to Binance’s latest estimate.
Binance promises to cover losses as investigation continues
Binance temporarily suspended deposits and withdrawals while conducting security checks and working with blockchain intelligence firms and law enforcement.
In a subsequent service update, Binance co-founder Yi He clarified that deposits remained unaffected and were operating normally. She said the exchange was improving its withdrawal systems and address controls, with withdrawals expected to resume within the next 48 hours.
The exchange said it would use its Secure Asset Fund for Users (SAFU) and company funds to cover losses. An updated Proof of Reserves will follow once remediation is completed.
Binance founder Changpeng Zhao publicly acknowledged the suspected breach, saying, “User funds are safe!” He added that he no longer managed the exchange but expected customers to be fully covered.
The exchange’s U.S. affiliate separately stated that its operations were not affected by the incident.
Binance said investigators were continuing to establish how the attacker accessed its internal systems and obtained the wallet authorizations. The company plans to publish a detailed technical post-mortem after completing its investigation.
