Key Takeaways:
- Hoskinson issued a warning about “seriously dangerous code” that is associated with the Binance hack.
- Based on an engineering researcher’s estimate, 50 EIP-7702 authorizations were directed at Binance 14.
- Even for EIP-7702, the account in question must still be properly cryptographically authorized.
Cardano’s founder Charles Hoskinson has echoed worries regarding Ethereum’s EIP-7702, following the investigators’ new allegation that the delegation function could be responsible for part of the massive Binance security breach.
The exchange has lost about $6.3 billion worth of crypto, based on recent reporting, but inquiries into the exact how the attackers obtained signing access continues.
Hoskinson Sounds Alarm Over Binance Sweeper Code
Hoskinson shared a technical breakdown from researcher CyberSatoshi with a blunt warning: “Careful, there is some seriously dangerous code out there.”
Careful, there is some seriously dangerous code out there. https://t.co/w7wM1nn0Lz
— Charles Hoskinson (@IOHK_Charles) October 30, 2026
The Binance wallet known as “Binance 14” was the target of a custom sweeper contract, the analysis states. When guiding the change of the wallet’s own ETH, it allegedly left precisely one ETH behind, which possibly meant that automated transaction systems continued to function as assets were taken away.
The contract also included a design that would continue to execute tokens even if their individual transfers were attempted to be failed.
Read More: Binance $5.5B Hack Exposed: 50 EIP-7702 Nonces Opened One Hot Wallet in Minutes
$823M USDC Vault Was Allegedly Within Reach
CyberSatoshi also stated that the wallet’s compromised execution function enabled it to act on an external vault that held some $823 million in USDC.
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8…6fae`) is wild.
This wasn’t a generic drainer. It was custom-engineered for Binance 14’s architecture:
– Leaves exactly 1 ether behind (`bal – 1 ether`) when sweeping ETH so Binance’s automated hot wallet queue wouldn’t error on gas and trip alarms.
– Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn’t revert the $6B batch.
– Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.They leave a comment: “robberies could be prevented if getaway cars were slower.”
You can’t fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would’ve killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { https://t.co/ou2j9VqGvv{value: bal – 1 ether}(“”); }`— CyberSatoshi 𓆙 (@XBToshi) October 30, 2026
Binance 14 supposedly knew more about that vault and delegated code can act on the basis of that wallet’s already granted just one activity.
They are presented based on researcher’s reconstruction and may not be reliable as Binance has confirmed. However, independent charges have reported seeing an EIP-7702 transaction that has 50 authorizations to be signed by Binance 14.
EIP-7702 Could Speed Execution, but It Cannot Forge Permission
The difference makes a lot of difference. EIP-7702 enables an EO A (Ethernet globally owned account) to delegate execution to the code of a smart contract. An authorization has a chain ID, an address of a delegate and a nonce and a signature. Ethereum checks out the signature prior to delegation.
This will prevent attackers from easily hijacking an arbitrary Binance wallet and loading malicious code on it. Cyber Satoshi’s team also noted that the criminal would have to obtain the private keys or have access to Binance’s signing systems which would be strong enough.
Delegated code, however, when granted access, can be made much more powerful on execution, as the code is executed within the context of the account.
Read More: Binance Says $6.3B Hit in Security Breach, $3B Frozen After DevOps Laptop Compromise
Ethereum Specification Already Warns of Delegation Risk
EIP-7702, officially written documentation of Ethereum, has a strong disclaimer that delegated code is available to full access of the account and should be carefully audited. The specification also relates to the fact that if the contracts of the delegates are not carefully crafted, the malicious party can essentially control the signer’s EOA with very few limitations.
The Binance incident of course gives rise to two distinct security concerns: firstly, how the attackers were able to acquire a valid signing key, and secondly, how it affected the speed and volume of asset transfers after the key was acquired.
Hoskinson’s message stresses the second point and the others are also the crux of uncovering the cause of the breach.
