Binance Hack: EIP-7702 Vulnerability Exploited to Steal $2.5 Billion
Written with artificial intelligence.
A recent hack on Binance exploited the EIP-7702 vulnerability, leading to the loss of approximately $2.5 billion from a hot wallet. The attacker sent 50 authorizations, with only one successfully executing the malicious code, prompting concerns about the security of wallet infrastructures.
Overview of the Attack
The hack on Binance highlights a significant security vulnerability associated with Ethereum's EIP-7702, introduced in May 2025. This update allows standard wallets to function like smart contracts. An attacker exploited this feature to drain the Binance 14 hot wallet, resulting in a loss of about $2.5 billion, part of a larger estimated total of $6.3 billion across multiple blockchains.
Technical Breakdown
Prior to EIP-7702, Ethereum maintained a clear distinction between externally owned accounts (EOAs) and contract accounts. EIP-7702 blurred these lines, allowing EOAs to authorize contracts to execute transactions on their behalf. This creates potential risks; if a malicious contract is authorized, the entire account can be compromised without needing to steal private keys directly.
The attacker signed 50 authorizations for the Binance 14 wallet, but only one matched the current nonce, allowing the malicious code to execute successfully. This led to the transfer of significant assets, including 167,464 ETH and $1.6 billion in USDT, shortly after the authorization.
Security Implications and Responses
Both Binance and security firm Blockaid indicated that the breach stemmed from a compromised internal service that could submit unauthorized withdrawal transactions, rather than a direct theft of private keys. Binance stated that it had frozen around $3 billion of the stolen assets, while TRM Labs estimated the total losses at $6.36 billion.
To mitigate such risks in the future, it is crucial for exchanges to implement stricter controls on transaction types and to utilize protective measures such as whitelisting contracts and conducting transaction simulations before execution. Binance has promised a detailed post-mortem of the incident once the investigation is complete, urging other exchanges to reassess their configurations to prevent similar exploits.