How Did EIP-7702 Turn Binance 14 Into a Sweeper?
Ethereum’s EIP-7702 allows a conventional externally owned account to temporarily execute smart-contract code. Introduced with the Pectra upgrade in May 2025, the feature enables functions such as transaction batching and sponsored gas payments without permanently converting a wallet into a smart contract.In the Binance attack, that flexibility became part of the exploit path.The attacker deployed a malicious sweeper contract and then submitted 50 EIP-7702 authorizations signed by the wallet Etherscan labels “Binance 14.” Each authorization covered a consecutive account nonce, giving the attacker a range of valid permissions while Binance continued processing transactions.Ethereum accepted the authorization matching nonce 18,914,809. Minutes later, the attacker called the delegated code and moved roughly 167,464 ETH and dozens of tokens, including about 1.6 billion USDT, from Binance 14.The wallet continued receiving customer deposits after the delegation was active, allowing the attacker to sweep additional funds later. The malicious authorization remained in place for nearly four hours before Binance revoked it.FinanceFeeds’ initial on-chain review of the Binance hack identified the Tornado Cash-funded attacker, the EIP-7702 delegation and the sweeper contract before Binance disclosed the full $6.3 billion impact.
Investor Takeaway
Why Did the Attacker Prepare 50 Valid Authorizations?
Binance 14 was processing frequent withdrawals, meaning its nonce changed constantly. A single authorization tied to one nonce could have become unusable before the attacker managed to submit it.The attacker appears to have solved that problem by obtaining 50 signed authorizations covering consecutive nonce values. Only the authorization matching the wallet’s next available nonce became valid; the remaining 49 were ignored.That preparation indicates the attacker had access to a mechanism capable of repeatedly obtaining valid Binance authorizations before executing the theft.The Ethereum activity was not isolated. Blockchain security firm Blockaid identified multiple Binance-controlled keys involved in signed activity during the wider incident, while Binance Co-CEO Richard Teng has said investigators have found no evidence that wallet private keys themselves were leaked. FinanceFeeds examined the apparent tension between multiple valid signatures and Binance’s no-key-leak finding.Those statements can both be true if an attacker compromised infrastructure capable of requesting legitimate signatures without actually extracting the underlying keys.
Does the DevOps Laptop Explain a Multi-Chain Theft?
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop. According to Teng, the compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions.Binance has since said investigators discovered additional points of breach beyond the laptop and cautioned that the attack was not a simple case of one employee’s permissions being abused.That distinction matters because EIP-7702 only exists on Ethereum. The attacker also moved 18,270 bitcoin, hundreds of millions of dollars in XRP and assets from several other networks through ordinary signed transactions.TRM Labs argues that the cross-chain pattern points toward a compromise of Binance’s signing infrastructure rather than a vulnerability limited to one blockchain.The analytics firm has attributed the theft with high confidence to North Korea’s TraderTraitor operation, while Chainalysis has reached a similar assessment. Binance has not publicly attributed the attack, and no U.S. government agency has formally identified the perpetrator. FinanceFeeds previously detailed the evidence linking the attack to the Lazarus-associated group.
Investor Takeaway
How Much of the $6.3 Billion Can Binance Recover?
Binance says approximately $3 billion of the affected assets have been frozen through cooperation with stablecoin issuers, blockchain networks and security partners.Tether, Circle and other issuers can blacklist centralized tokens such as USDT and USDC, but assets including bitcoin and ether cannot be frozen through an issuer in the same way. The attacker still controls large cryptocurrency balances that can be moved through swaps, bridges and other laundering routes.Binance has pledged to cover all losses through SAFU and company funds. Its emergency fund was created after earlier exchange security incidents and held roughly $1 billion before the attack, meaning the corporate balance sheet may ultimately carry a substantial portion of any unrecovered loss.Law-enforcement involvement now adds a second recovery channel. Binance is cooperating internationally, including with the FBI and Secret Service, as investigators trace wallets and try to identify infrastructure or counterparties that can still interrupt the movement of funds.