Binance Hack: How Attackers Drained Billions via EIP-7702
A new analysis of the October 29 Binance hack shows attackers started by compromising developer machines, then abused Ethereum's EIP-7702 to install sweeper code that kept draining funds for almost four hours despite the exchange's alerts.
⚡ Why it matters
Strong withdrawal controls are not enough when developers are the weak link and there is no pretested kill switch, a lesson for every crypto business.
On October 29, thieves moved about $6.34 billion in crypto from at least 11 Binance wallets. Binance later froze and recovered about $2.85 billion. The FBI attributed the attack to North Korea's TraderTraitor group.
How it started
According to Binance's post-mortem, developers were the entry point. One downloaded a compromised Homebrew build for Mac, and another fell for a fake job interview whose coding "assignment" infected his machine. The attackers used three developers' systems to gain signing privileges and prepared 50 presigned authorizations.
The EIP-7702 angle
EIP-7702 lets an Ethereum account delegate to smart contract code that acts on its behalf. The attackers sent all 50 authorizations at once, since each needs a valid nonce and only one had to match. That installed a sweeper that emptied the main treasury wallet of about $2.5 billion, leaving a single ETH. Because such a delegation names neither an amount nor a recipient, normal withdrawal checks don't catch it.
Binance's systems alerted within minutes, but pausing withdrawals and hot wallets did not cancel the on-chain authorizations. Draining continued from 20:05 to 23:56 UTC.
Lessons
Experts recommend:
- Simulate transactions before signing and enforce size and destination policies.
- Alert on bursts of large transfers and keep a prebuilt, tested kill switch that pauses signing and wallet refills.
- Protect developers with dedicated, isolated signing machines and training on fake recruiter lures.
- Be able to revoke identities and tokens within minutes, and test it regularly.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
Operation TorNado: 354 Dark Web Vendors and Buyers Arrested
Europol and the US Justice Department announced 354 arrests of vendors and buyers on dark web markets including Archetyp, Nemesis, Tor2Door, Bohemia and Kingdom, in a 14-country operation called TorNado.
German Law Gives Spy Agencies Hacking and Sabotage Powers
Germany's Bundestag passed a law on Friday letting intelligence agencies hack foreign systems, disrupt adversaries' supply chains and knock offline servers operated by hostile state hacking groups.
ArcticRAT Android Malware Uses AI to Profile Victims
Zimperium reports that ArcticRAT has evolved from an Android crypto stealer into a remote access Trojan (RAT) that takes over devices and uses an AI model to sift stolen messages for financial information.