Key Takeaways:
A fresh on-chain analysis is shedding light over how one of the biggest crypto theft incidents in history ever occurred around Binance’s hot-wallet system.
According to Blockaid, an attacker took a single Ethereum type-4 transaction with 50 EIP-7702 authorizations, betting on a different nonce of each transaction until it matched Binance 14’s active nonce.
The attacker didn’t know Binance 14’s live nonce.
So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx.
Only 1 of 50 was a hit.
A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed. https://t.co/XFWqW6ezXw
— Blockaid (@blockaid_) October 29, 2026
At 20:20:59 UTC on Oct. 29, the attacker submitted 50 authorizations covering nonces from 18,914,775 to 18,914,824. Binance 14 was still doing pullouts, and because of this, its nonce was fluctuating. The attacker didn’t know the value of exactly what he had been given, he only knew it was in a range.
The 49 authorizations were not allowed and one was, Blockaid reports. This authorization, found successful by Binance, was made by them to an attacker-controlled sweeper contract. The attacker invoked the contract, and drained the wallet about 3 minutes later.
Read More: Binance Pay Opens Crypto Payments at Millions of PayPay Merchants Across Japan
EIP-7702 extends Ethereum’s capabilities to allow for an externally owned account to temporarily act as a smart-contract account, delegating execution to code. In this instance, there was a delegated contract with very broad functionality that could present the capability to transfer tokens and ETH from the wallet.
In the first major sweep, the share of the tokens transferred by Blockaid were approximately 167,464 ETH, 1.615B USDT and dozens of other tokens, valued around USD 2.5 billion as of the time of writing. The delegation was maintained after that, which could eventually result in additional funds being swept without requiring additional authorization.
It would seem that the attack on Binance didn’t end there. According to Blockaid, other Binance-controlled wallets transferred funds to addresses that have been associated with the same operation at Ethereum, Optimism, Arbitrum and Avalanche. Other estimates from the public also identified an outflow of Bitcoin and Tron as the cause of the attack.
The final damage tally will follow the incident but the latest tally for Blockaid was at least $5.5 billion.
Binance announced that it is aware of an “eventual security breach” and is investigating the possible way, without making it public. The exchange stated that the funds of users are secure.
Read More: Binance Unleashes 7 AI Agent Skills, Turning Bots into Full-Stack Crypto Traders
The suspicious transfers have prompted issuers of stablecoins to act swiftly. As of 29th October, Binance reported that the value of the assets involved in the incident had been frozen for over $2.54 billion. Nearly $1.57 billion was frozen by Tether and over $800 million was frozen by Circle. Crypto companies, like Ripple, were not exempted from the freezing of assets.
EIP-7702 is in the spotlight once more, thanks to the incident, as it doesn’t require a breaking of Ethereum itself. Rather, it was a valid authorization to allow an authorization process controlled by the attacker to take over execution of a hot wallet.
Soon after the first sweep, Blockaid detected the malicious delegation and identified the EIP-7702 mechanism within minutes, it said.
The post Binance $5.5B Hack Exposed: 50 EIP-7702 Nonces Opened One Hot Wallet in Minutes appeared first on CryptoNinjas.
The Binance attacker spent at least 36 hours preparing for the $6.36 billion crypto exchange hack that began with $296 million in XRP. According to
The 2026 figure is more than double the prior year’s total.
The remaining two wallets received 832.5 BTC and 437.7 BTC; all 19 still held their balances at the latest check.
The wallet remains associated with about $1.12 billion in ETH. Tornado Cash may be a next destination for the transferred funds.
Blockchain Bodega is here and you know the vibes. We’re at the intersection of hip-hop culture and web3, exploring this new digital frontier. Who better to guide you through these uncharted lanes than Ock Chain – The Bitcoin Boss and the Consensus Corner Boys?
Ock Chain doesn’t just cook up random details about cryptocurrency; he lives it. Ock’s been deep in the game since Bitcoin was just a baby.
And let’s not forget about the Consensus Corner Boys. They’re our skilled crew of blockchain enthusiasts. They’re here to educate, entertain, and enlighten.
Welcome to Blockchain Bodega!
Copyright © 2023 Blockchain Bodega. All rights reserved.