Google Analytics counts our visits, with cookies. No thanks turns it off and removes its cookies; in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, it stays off unless you accept. Cookie Notice

Advertise
PRICES
BTCETHSOLXRPBNBTONDOTLTCPOLHBARNEARARBUNI
Back to NewsFeeds

SlowMist's Cos says Binance hacker used EIP-7702 to sweep hot-wallet tokens

NewsFeeds update

SlowMist's Cos says the attacker behind the Binance hack used Ethereum's EIP-7702 mechanism simply to sweep tokens from Binance-linked hot wallets in bulk, after several hours of rehearsal. The mechanism itself is not at fault, Cos said, as other methods exist.

EthereumOdailyAIBearish

Read the original on Odaily

The story so far: Binance hot wallet hack

Tree News flagged a possible theft from a Binance hot wallet, with over 60 tokens moved to an address linked to Tornado Cash. SlowMist's Cos said the attacker used EIP-7702 to sweep tokens from Binance-linked hot wallets after rehearsal. SlowMist CISO 23pds says a private-key leak or compromised signing machine…

  1. Tree News says signs emerge of possible theft from Binance hot wallet

    Tree News says signs point to possible theft from a Binance hot wallet, with more than 60 tokens moved to an address previously known to have received funds via Tornado Cash. About $2.77bn moved across five blockchains; whether it was a hack is unconfirmed.

    AltcoinsCoinNessAIBearish

  2. Attackers allegedly used EIP-7702 delegation to redirect Binance wallet to malicious code

    Attackers allegedly used EIP-7702 delegation to point a Binance wallet at malicious code and move funds. How they obtained authorisation is still under investigation, with a stolen private key or a compromised signing flow both unconfirmed possibilities.

    EthereumOdailyAIBearish

  3. Binance said to still sweep new user deposits into compromised hot wallet

    Bitcoin News monitoring indicates Binance is still running automatic deposit sweeping that moves new user deposits into the compromised hot wallet, with the attacker said to keep moving funds out as they arrive. Users are advised to avoid depositing until the incident is resolved.

    BitcoinOdailyAIBearish

  4. Binance reportedly recovers $823m in USDC after wallet exploit

    On-chain analysis cited by Bitcoin News indicates attackers used a malicious EIP-7702 approval to control a Binance wallet, and Binance reportedly used a signing key to recover $823m in USDC. The attackers allegedly moved 65 assets, with a $200m USDT deposit transferred out 100 seconds after arriving.

    StablecoinsOdailyAIBearish

  5. Binance moves funds from at-risk wallets to cold storage after major hack

    Binance is shifting funds from every wallet exposed to hacking risk into cold wallets, after what Solid Intel called the largest hack on record overnight.

    BitcoinCoinNessAIBearish

  6. Developer 0xjustadev warned of EIP-7702 theft risk two years ago, X user says

    X user 0xVEER said developer 0xjustadev warned during EIP-7702 discussions about two years ago that the proposal could enable attackers to control wallets. Whether the Binance incident involved EIP-7702 is unconfirmed by Binance.

    EthereumChainCatcherAIBearish

  7. Blockaid CEO Ido Ben-Natan says Binance hack may have abused signing system

    Blockaid co-founder and CEO Ido Ben-Natan says the Binance hack may have abused transaction-signing infrastructure rather than stolen private keys, with 50 EIP-7702 approvals bundled into one transaction. He said the method resembled the 2025 Bybit hack.

    EthereumCoinNessAIBearish

  8. SlowMist's Cos says Binance hacker used EIP-7702 to sweep hot-wallet tokens

    SlowMist's Cos says the attacker behind the Binance hack used Ethereum's EIP-7702 mechanism simply to sweep tokens from Binance-linked hot wallets in bulk, after several hours of rehearsal. The mechanism itself is not at fault, Cos said, as other methods exist.

    EthereumOdailyAIBearish

  9. Binance 14 hot wallet revokes EIP-7702 authorisation after alleged hack

    One of the Binance hot wallets allegedly drained in a hack, Binance 14, revoked its EIP-7702 authorisation at 00:10 UTC on 30 Oct, on-chain data shows. The attack allegedly abused the mechanism to hand control of the wallet to a malicious sweeper contract.

    EthereumChainCatcherAIBearish

  10. Derek Chiang says EIP-7702 has no flaw but aided Binance attacker

    ZeroDev founder Derek Chiang says EIP-7702 itself has no vulnerability, but its transaction batching let the Binance attacker move ETH, USDT and 62 other tokens in one transaction. He says the attacker needed a private key or a signed authorisation.

    EthereumOdailyAIBearish

  11. SlowMist CISO says Binance theft probe should focus on private-key leak and custom withdrawal tools

    SlowMist's chief information security officer, 23pds, says how attackers bypassed Binance's risk controls still needs confirming, with a private-key leak or a compromised signing machine the lines to check. 23pds leans towards a private-key leak and says a custom withdrawal tool was probably used.

    AltcoinsOdailyAIBearish

More Ethereum updates

  1. Hackers linked to Binance attack move over $1bn in ETH to new wallets

    EthereumOdailyAIBearish

  2. Whale with $125m ETH long closes 36,517 ETH, losses top $38m

    EthereumOdailyAIBearish

  3. Derek Chiang says EIP-7702 has no flaw but aided Binance attacker

    EthereumOdailyAIBearish

Every Ethereum update on NewsFeeds

Every update is a short rewrite, by AI in our own words, of a flash from the outlet named on it, credited and linked. Updates are joined into one story by AI; our editors can change a story’s name or take an update out. Not investment advice.