Key Takeaways:
- In total, the attackers utilized 50 EIP-7702 authorizations for Binance 14.
- A single nonce was found correct, triggering the attack on the delegation.
- Blockaid estimated that at least $5.5 billion was lost due to the wider incident.
A fresh on-chain analysis is shedding light over how one of the biggest crypto theft incidents in history ever occurred around Binance’s hot-wallet system.
According to Blockaid, an attacker took a single Ethereum type-4 transaction with 50 EIP-7702 authorizations, betting on a different nonce of each transaction until it matched Binance 14’s active nonce.
The attacker didn’t know Binance 14’s live nonce.
So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx.
Only 1 of 50 was a hit.
A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed. https://t.co/XFWqW6ezXw
— Blockaid (@blockaid_) October 29, 2026
50 EIP-7702 Authorizations Produced One Successful Hit
At 20:20:59 UTC on Oct. 29, the attacker submitted 50 authorizations covering nonces from 18,914,775 to 18,914,824. Binance 14 was still doing pullouts, and because of this, its nonce was fluctuating. The attacker didn’t know the value of exactly what he had been given, he only knew it was in a range.
The 49 authorizations were not allowed and one was, Blockaid reports. This authorization, found successful by Binance, was made by them to an attacker-controlled sweeper contract. The attacker invoked the contract, and drained the wallet about 3 minutes later.
Read More: Binance Pay Opens Crypto Payments at Millions of PayPay Merchants Across Japan
EIP-7702 Turned the Hot Wallet Into a Programmable Account
EIP-7702 extends Ethereum’s capabilities to allow for an externally owned account to temporarily act as a smart-contract account, delegating execution to code. In this instance, there was a delegated contract with very broad functionality that could present the capability to transfer tokens and ETH from the wallet.
In the first major sweep, the share of the tokens transferred by Blockaid were approximately 167,464 ETH, 1.615B USDT and dozens of other tokens, valued around USD 2.5 billion as of the time of writing. The delegation was maintained after that, which could eventually result in additional funds being swept without requiring additional authorization.
Binance Incident Expanded Beyond a Single Wallet
It would seem that the attack on Binance didn’t end there. According to Blockaid, other Binance-controlled wallets transferred funds to addresses that have been associated with the same operation at Ethereum, Optimism, Arbitrum and Avalanche. Other estimates from the public also identified an outflow of Bitcoin and Tron as the cause of the attack.
The final damage tally will follow the incident but the latest tally for Blockaid was at least $5.5 billion.
Binance announced that it is aware of an “eventual security breach” and is investigating the possible way, without making it public. The exchange stated that the funds of users are secure.
Read More: Binance Unleashes 7 AI Agent Skills, Turning Bots into Full-Stack Crypto Traders
More Than $2.5B in Crypto Has Already Been Frozen
The suspicious transfers have prompted issuers of stablecoins to act swiftly. As of 29th October, Binance reported that the value of the assets involved in the incident had been frozen for over $2.54 billion. Nearly $1.57 billion was frozen by Tether and over $800 million was frozen by Circle. Crypto companies, like Ripple, were not exempted from the freezing of assets.
EIP-7702 is in the spotlight once more, thanks to the incident, as it doesn’t require a breaking of Ethereum itself. Rather, it was a valid authorization to allow an authorization process controlled by the attacker to take over execution of a hot wallet.
Soon after the first sweep, Blockaid detected the malicious delegation and identified the EIP-7702 mechanism within minutes, it said.
