An attack carried out on October 29 across roughly ten blockchains drained an estimated $6.3 billion from Binance, according to the exchange's own figure, with blockchain analytics firm TRM Labs putting the total at $6.36 billion. The single largest loss came from the exchange's "Binance 14" hot wallet, which lost approximately $2.5 billion through a mechanism built into Ethereum since May: EIP-7702.
EIP-7702 was activated on May 7, 2025 as part of the Pectra upgrade, a feature pushed by Ethereum co-founder Vitalik Buterin. It allows a regular wallet, known as an externally owned account, to behave like a smart contract by delegating its execution to a contract through the owner's signature. The upgrade had gone without incident since launch.
An EIP-7702 authorization requires a signature from the account's private key, the chain ID, and the account's exact nonce, the sequential counter tied to every address. Validity is checked against that precise nonce at the moment a block includes the transaction. In this case, the attacker signed 50 separate authorizations for Binance 14, spanning nonce 18,914,775 to 18,914,824, all bundled into a single type-4 transaction, the format introduced by Pectra. Security firm Blockaid, which detected the operation, summarised the outcome bluntly: "Only one out of 50 hit the mark."
That one matching authorization was enough. According to Etherscan, the delegating transaction landed at 20:20 UTC on October 29. Blockaid recorded the first transfer out of Binance 14 just 3 minutes and 24 seconds later: 167,464 ETH, $1.6 billion in USDT, and roughly sixty other tokens. The same attacker role was used separately to pull $823 million in USDC from another smart wallet.
A hack spread across ten chains
Per TRM Labs' breakdown, Ethereum accounted for about $3.79 billion of the total, including Binance 14, the $823 million USDC extraction, and other Binance hot wallets. Bitcoin followed at roughly $1.47 billion, or 18,270 BTC. Tron losses reached about $628 million, including $612.7 million in USDT and TRX. The XRP Ledger lost around $296 million, equal to 233.46 million XRP, and was in fact the first chain hit, drained 15 minutes before Binance 14. Solana losses stood at about $96 million, while Arbitrum, Optimism, Base, Avalanche and Polygon combined added roughly $77 million. Blockaid's own tally, counting only Ethereum, Bitcoin and Tron, reached $5.57 billion.
Binance says it froze approximately $3 billion on-chain, crediting cooperation from Tether and Circle, which blocked stolen USDT and USDC before the funds could move further.
Two competing explanations
Binance's update attributes the breach to a compromised DevOps engineer's laptop, which the company says allowed the attacker to "access a service container and submit unauthorized withdrawal transactions." The exchange maintains there is "no evidence of private key leakage." Blockaid's chief executive, Ido Ben-Natan, described the episode as a "misuse of the key."
TRM Labs reaches a different conclusion, stating the incident reflects "a compromise of the hot wallets' signing infrastructure" rather than a single endpoint device. Binance has promised a detailed post-mortem once its investigation concludes.
For custodians handling large Ethereum balances, the episode exposes a narrow but consequential detail of EIP-7702: an authorization is either accepted outright at the correct nonce or discarded, with no partial failure state in between. Out of fifty attempts, one was all that was required.
