A feature introduced on Ethereum in 2025 to make cryptocurrency wallets easier to use was one of the tools deployed in the multi-billion-dollar hack against Binance. Known as EIP-7702, the technology allowed the attackers to take control of an exchange wallet and steal roughly $2.5 billion in ETH and other tokens in under four minutes.

That figure accounts for only part of the roughly $6.3 billion stolen from Binance on Thursday (29), in the largest hack ever recorded in the cryptocurrency market. The intrusion spanned several blockchains, including Bitcoin, Ethereum, Solana and Tron, and has raised questions about the security of the systems large exchanges use to authorise transactions.

According to an investigation published by CoinDesk on Friday, the attacker managed to use a valid digital authorisation to make a Binance wallet execute a smart contract under their control. This allowed them to move funds without needing fresh approval from the exchange for each transfer.

The attack exploited a characteristic of EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025. The feature was designed to make wallets more flexible and simplify everyday operations, but it can also pose a risk when users or institutions authorise the execution of malicious code.

How the Ethereum upgrade was used in the attack

To understand the attack, it helps to understand how EIP-7702 works. Before this upgrade, traditional Ethereum wallets were controlled directly by private keys, which authorised every transaction. Smart-contract wallets, by contrast, could already carry out more complex operations, such as setting spending limits or bundling several transfers together.

Read also: Binance has a $1 billion fund after the $6 billion hack. What about customer money?

EIP-7702 brought these two models closer together by letting traditional wallets use smart-contract features without having to move their funds to another address.

In practice, this means a wallet can authorise external code to carry out certain operations. Legitimate uses include bundling several transactions into a single operation and letting a third party pay the network fees.

The problem is that if the authorised contract is malicious, it can also move the wallet's funds. What's more, the authorisation can remain valid until it is replaced or revoked, allowing further transfers to go through as long as the code stays active.

It was precisely this mechanism that surfaced in the investigation into the attack on Binance.

According to CoinDesk's reconstruction of the transactions, the attacker prepared a smart contract designed to automatically drain funds from a wallet identified as "Binance 14".

At 5:20pm on Thursday, Brasília time, the attacker submitted a transaction containing 50 digital authorisations signed by Binance's own wallet. All of them delegated control of the wallet to the malicious contract.

The high number of authorisations had a technical explanation. Because the wallet was processing a large volume of operations, its transaction counter, known as the nonce, was constantly changing. The attacker used signatures covering 50 consecutive values of that counter to increase the odds that at least one would be accepted by the network.

The strategy worked. One of the authorisations was validated by Ethereum, allowing the attacker's contract to begin operating through the exchange's wallet.

Less than four minutes later, at 5:24pm, roughly 167,464 ETH and 63 other tokens were withdrawn, including around $1.6 billion in USDT.

The intrusion did not stop there. Because Binance's systems kept routing deposits to the compromised wallet, the attacker was able to withdraw further funds in two additional operations, at 6:04pm and 6:44pm.

According to TRM Labs, the attacker also used the control gained over Binance 14 to move roughly $823 million in USDC from another exchange wallet, identified as Hot Wallet 34.

The malicious authorisation remained active for nearly four hours and was only revoked in the early hours of Friday.

How did the hacker obtain the authorisations?

Although the blockchain data shows how the money was withdrawn, it is still not fully clear how the attacker obtained the signatures needed to carry out the attack.

This is a central point of the investigation, because EIP-7702 requires a valid authorisation from the wallet whose behaviour will be modified. The attacker therefore could not simply pick a wallet and seize control of it without obtaining a signature the network would recognise.

Richard Teng, Binance's co-CEO, said on Friday that initial investigations pointed to the compromise of a DevOps engineer's computer at the company. The early suspicion was that the breach had granted access to a services container used by the exchange.

However, Binance later said it had found other points of compromise during the investigation, indicating the attack was more complex than initially thought.

According to Teng, no evidence has been found of wallet private keys being leaked, and it has not yet been possible to determine exactly how the attackers produced the authorisations used across the different blockchains.

One hypothesis under consideration is that the attackers compromised the infrastructure responsible for signing Binance's transactions, causing the company's own systems to produce authorisations that appeared legitimate.

This possibility gains weight because the attack was not confined to Ethereum. The attackers also managed to transfer 18,270 bitcoins, hundreds of millions of XRP, and funds from wallets on other networks that do not use EIP-7702.

In other words, although the Ethereum upgrade was exploited to withdraw part of the funds, it does not by itself explain the multi-billion-dollar breach.

TRM Labs identified features similar to those of previous attacks attributed to North Korean hackers, including the $1.5 billion breach of Bybit in February 2025. The blockchain analytics firm expressed high confidence in the involvement of the same criminal group, although Binance has not yet confirmed who was responsible.

Does EIP-7702 pose a risk to Ethereum users?

The episode has also reignited debate over the risks associated with EIP-7702, one of the main additions in the Pectra upgrade, designed to bring traditional wallets closer to the functionality offered by smart contracts.

The proposal, co-authored by Ethereum co-founder Vitalik Buterin, aims to improve the user experience by allowing simpler, more flexible operations and reducing the steps needed to use decentralised applications.

However, EIP-7702's own technical documentation acknowledges the risks of delegating permissions, since an authorised contract can be granted broad powers to act on behalf of the wallet.

The problem had already drawn the attention of specialists shortly after the upgrade was implemented. In June 2025, the trading firm Wintermute found that more than 80% of delegations made through EIP-7702 pointed to copies of the same malicious contract, designed to automatically transfer funds out of compromised wallets.

This does not mean, however, that the upgrade contains a vulnerability that allows anyone's cryptocurrency to be stolen. The risk arises when a valid authorisation is granted to malicious code, whether through scams that trick a user into signing permissions, or through the compromise of the systems responsible for producing those signatures.

In Binance's case, the investigation points to this second possibility, although the exact origin of the authorisations has not yet been established.

The episode shows that a feature developed to make cryptocurrency easier to use can also amplify the damage of an intrusion if the authorisation mechanisms themselves are compromised.

While the investigation continues, Binance says it will cover the losses using its own funds and its user protection fund, known as SAFU. The exchange also said that roughly $3 billion of the affected assets had already been frozen, mainly with the help of stablecoin issuers. The freeze, however, does not necessarily mean all of these funds will be recovered.

Your gateway to bitcoin, the world's largest cryptocurrency, is MB. It's simple, secure and transparent. Stop putting off an investment with enormous potential. Invest in just a few clicks!