Attackers allegedly used EIP-7702 delegation to redirect Binance wallet to malicious code

The story so far: Binance hot wallet hack

Tree News flagged a possible theft from a Binance hot wallet, with over 60 tokens moved to an address linked to Tornado Cash; Binance reportedly recovered $823m in USDC. Attackers allegedly used EIP-7702 delegation to point a Binance wallet at malicious code. Blockaid CEO Ido Ben-Natan says the hack may have abused…

1. 29 Oct 202620:46 UTC

   Tree News says signs emerge of possible theft from Binance hot wallet

   Tree News says signs point to possible theft from a Binance hot wallet, with more than 60 tokens moved to an address previously known to have received funds via Tornado Cash. About $2.77bn moved across five blockchains; whether it was a hack is unconfirmed.

   AltcoinsCoinNessAIBearish

2. 29 Oct 202622:28 UTC

   Attackers allegedly used EIP-7702 delegation to redirect Binance wallet to malicious code

   Attackers allegedly used EIP-7702 delegation to point a Binance wallet at malicious code and move funds. How they obtained authorisation is still under investigation, with a stolen private key or a compromised signing flow both unconfirmed possibilities.

   EthereumOdailyAIBearish

3. 29 Oct 202622:32 UTC

   Binance said to still sweep new user deposits into compromised hot wallet

   Bitcoin News monitoring indicates Binance is still running automatic deposit sweeping that moves new user deposits into the compromised hot wallet, with the attacker said to keep moving funds out as they arrive. Users are advised to avoid depositing until the incident is resolved.

   BitcoinOdailyAIBearish

4. 29 Oct 202622:58 UTC

   Binance reportedly recovers $823m in USDC after wallet exploit

   On-chain analysis cited by Bitcoin News indicates attackers used a malicious EIP-7702 approval to control a Binance wallet, and Binance reportedly used a signing key to recover $823m in USDC. The attackers allegedly moved 65 assets, with a $200m USDT deposit transferred out 100 seconds after arriving.

   StablecoinsOdailyAIBearish

5. 29 Oct 202623:27 UTC

   Binance moves funds from at-risk wallets to cold storage after major hack

   Binance is shifting funds from every wallet exposed to hacking risk into cold wallets, after what Solid Intel called the largest hack on record overnight.

   BitcoinCoinNessAIBearish

6. 29 Oct 202623:52 UTC

   Developer 0xjustadev warned of EIP-7702 theft risk two years ago, X user says

   X user 0xVEER said developer 0xjustadev warned during EIP-7702 discussions about two years ago that the proposal could enable attackers to control wallets. Whether the Binance incident involved EIP-7702 is unconfirmed by Binance.

   EthereumChainCatcherAIBearish

7. 30 Oct 202600:29 UTC

   Blockaid CEO Ido Ben-Natan says Binance hack may have abused signing system

   Blockaid co-founder and CEO Ido Ben-Natan says the Binance hack may have abused transaction-signing infrastructure rather than stolen private keys, with 50 EIP-7702 approvals bundled into one transaction. He said the method resembled the 2025 Bybit hack.

   EthereumCoinNessAIBearish