Key Takeaways
- EIP-7702 enabled Binance’s main Ethereum wallet sweep but does not explain the full $6.3 billion theft.
- Roughly $3.66 billion moved through other routes, including ordinary Ethereum transfers and withdrawals on other blockchains.
- Ethereum’s specification warns that delegated code gains unrestricted access to accounts, underscoring the need for strict signing controls.
Ethereum’s EIP-7702 wallet upgrade has become a focal point in debate over Binance’s $6.3 billion hack. Yet the attack extended far beyond the Ethereum wallet delegation that attracted scrutiny.
Using figures circulating among researchers, approximately $2.7 billion moved through the main delegation-enabled sweep, while roughly $3.66 billion moved through other routes.
That remainder includes ordinary Ethereum transfers as well as withdrawals to other blockchains; it does not represent losses exclusively outside Ethereum.
The distinction shifts attention toward the broader authorization failure: how an attacker obtained valid signatures across Binance’s wallet infrastructure.
EIP-7702 Enabled a Sweep, but Cannot Explain the Entire Theft
EIP-7702 allows an ordinary Ethereum account to delegate execution to smart contract code through a signed authorization. The feature supports functions such as transaction batching and sponsored fees.
In Binance’s case, investigators found that the attacker used this mechanism to install a malicious sweeper on the Binance 14 hot wallet.
The operation included 50 previously signed authorizations covering consecutive transaction counts, known as nonces. Preparing multiple possibilities increased the likelihood that an authorization would match the busy wallet’s current counter when submitted.
Once active, the malicious delegation allowed the attacker to drain assets and sweep subsequent deposits.
But EIP-7702 cannot explain withdrawals on Bitcoin, Tron, Solana, or the XRP Ledger. TRM Labs also identified ordinary signed transfers from another Binance Ethereum wallet.
TRM valued total Ethereum outflows at approximately $3.79 billion, further showing why the main $2.7 billion sweep should not be confused with the entire Ethereum loss.
The approximately $3.66 billion remainder therefore describes activity outside that sweep, rather than a precise chain-by-chain attribution.
Binance’s Preliminary Findings Point to Compromised Withdrawal Access
Binance said its initial investigation suggested that an attacker compromised a DevOps engineer’s laptop, accessed a service container and submitted unauthorized withdrawal transactions.
The exchange said investigators had found no evidence of leaked wallet private keys. It promised a detailed technical post-mortem once the investigation established the facts.
That finding leaves a critical possibility: attackers may have abused infrastructure authorized to request signatures without extracting the underlying keys.
TRM assessed that the coordinated transfers pointed toward compromised hot-wallet signing infrastructure. However, claims describing a specific hijacked signing queue, hardware-vault configuration or exact internal approval bypass remain unconfirmed.
Likewise, evidence of attack preparation does not establish how long the intruder controlled Binance’s internal systems. Preparatory blockchain transactions and internal network access represent different stages.
The security question extends beyond where keys reside. A protected key can still authorize a harmful transaction if surrounding systems submit malicious instructions and approval controls fail to reject them.
Ethereum’s Own Specification Warns About Delegation Risks
EIP-7702’s published specification explicitly warns that delegated code receives unrestricted access to the authorizing account. It says wallets must closely audit that code and cautions against interfaces that let applications casually request delegation signatures.
Those warnings make authorization policy central to deployment. They do not establish that Ethereum’s protocol malfunctioned during Binance’s breach.
The incident instead raises questions about whether Binance’s signing controls recognized the consequences of the requested authorizations and whether separate blockchain operations shared excessive access.
Binance said partners had frozen approximately $3 billion and pledged to cover losses through SAFU and company funds. It also revoked the affected authorization and promised updated proof of reserves after remediation.
Frozen assets may reduce eventual losses, but they do not resolve the technical cause.
For exchanges reviewing their defenses, the central lesson concerns transaction authority: protecting private keys must be paired with controls over what those keys can sign.
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
