Binance Hack Used Ethereum EIP-7702 to Sweep $2.5 Billion

An Ethereum wallet authorization using EIP-7702 enabled a single $2.5 billion sweep during the Oct. 29 Binance breach, showing how the network feature let attackers move assets from an exchange hot wallet in one transaction. A transaction at 4:20:59 p.m. ET (20:20:59 UTC) contained 50 authorizations signed by Binance’s “Binance 14” wallet. One matched the wallet’s nonce and delegated it to attacker-controlled code. Three minutes and 24 seconds later, a sweep transferred 167,464 Ether (ETH) and tokens including 1.615 billion Tether (USDT), valued at about $2.5 billion at the time.