Skip to content
Blockchain Posts

exploit

Binance loses $6.3B to EIP-7702 sweeper after DevOps laptop compromise

A compromised Binance DevOps laptop let an attacker drain hot wallets via an EIP-7702 delegation sweeper on Oct 29. Binance puts the impact at $6.3B, with roughly $3B frozen on-chain.

by 5 min read
exploitbinanceethereumlazaruson-chain

Binance says a compromised DevOps engineer's laptop opened the path for the largest single-exchange theft on record: an attacker used EIP-7702 account-abstraction delegations to turn Binance's own hot wallets into sweepers that forwarded funds to a fresh address. The exchange's current impact estimate is $6.3 billion, of which about $3 billion has been frozen on-chain by issuers and bridges. Deposits and withdrawals remain suspended; co-CEO Yi He pledged to cover all user losses.

What happened

The first on-chain signal landed at 20:20 UTC on Oct 29, when Binance's Binance 14 hot wallet (Etherscan label; address 0x28C6c06298d514Db089934071355E5743bf21d60) was emptied of 167,464 ETH in roughly four minutes. Minutes earlier, a BTC hot wallet pushed 18,270 BTC through 11 transactions in block 973,732. By midnight UTC, blockchain-analysis firms were tracking an exposure in the single-digit billions. Binance later published a preliminary cause: a service container used by DevOps was reached from a compromised engineering laptop, which then signed unauthorized withdrawal flows. Binance says no private keys were exfiltrated.

Mechanism — EIP-7702 turned a hot wallet into a sweeper

EIP-7702, active on Ethereum mainnet since the Pectra upgrade, lets an externally-owned account (EOA) temporarily delegate its execution to contract code via a signed authorization. The attacker:

  1. Deployed a sweeper contract hours earlier, funded via Tornado Cash — a pattern first flagged by on-chain researcher Spreek and later corroborated by CoinDesk's trace.
  2. Submitted 50 pre-signed EIP-7702 authorizations across 50 nonces, one bundled against a captured session, pointing Binance 14 at the sweeper.
  3. Fired the batch: for the window the delegation was active, any ETH or ERC-20 balance landing in the wallet was immediately forwarded to attacker addresses.

Because the delegation lives on the signing EOA, Binance could not stop the drain by rotating a smart-contract admin key; it had to revoke the authorization and migrate reserves off the wallet. CoinDesk's walk-through, cross-referenced against Etherscan, puts the ETH drain at four minutes end-to-end.

On-chain trail

  • Primary drain wallet: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c.
  • Exploiter 8 (Arkham label): 0x8532FA14ACAf483729C449b8458aedDb900543D4 — held 195,460 ETH at 22:03 UTC, worth roughly $442M at the time.
  • Exploiter 11: 0x897C80d1a9729E94460e2Bd93178bD5215158DF3 — 57,891.77 ETH.
  • BTC laundering pattern: the stolen bitcoin now sits across 19 addresses, 17 of which hold exactly 1,000 BTC each, one holds 832.5 BTC, and the final address holds 437.7 BTC (landed in block 973,738 at 20:48 UTC). None has moved since. CoinDesk notes a classic peel-chain layout rather than an immediate mixer attempt.
  • The attacker also deposited $60M USDT to Aave, borrowed 19,762 ETH against it, and swapped portions of stolen USDT into ETH and TRX via UniswapX — moves Arkham characterizes as attempts to get past Tether's token-freeze mechanism. The Defiant puts the USDT→ETH/TRX swap volume at $911 million.

Numbers block

  • Total impact: ~$6.3B (Binance) / $6.4B (Chainalysis).
  • Frozen on-chain: ~$3B (Binance), $2.8B (Arkham), $2.7B (Nansen).
  • Reserve impact: ~204,500 ETH taken, roughly 5.6% of Binance's reported ETH reserves; ETH backing dropped to about 94% until replenishment.
  • Frozen by issuer (per CoinDesk, citing exchange execs): >$1.567B USDT (Tether CEO Paolo Ardoino), ~$823M USDC (Circle, per Binance), ~$200M RLUSD (Ripple), $27M USD1 (World Liberty Financial).
  • Binance SAFU fund: roughly $1B in BTC available to cover user losses before the exchange taps equity.
  • Next proof-of-reserves snapshot: Nov 1.

Attribution — hedged

  • Chainalysis publicly links the drain to North Korea's Lazarus Group, per The Defiant's reporting of a Chainalysis statement.
  • TRM Labs attributes to the DPRK unit it tracks as TraderTraitor, per French-language coverage from Journal du Coin.
  • The FBI, OFAC, and the Treasury have not issued a formal attribution as of this writing. The attribution rests on two blockchain-analysis firms.

What to watch

  1. Whether Yi He's 48-hour withdrawal reopening pledge holds. Reserves need to be migrated to new keys and audited before withdrawals can safely resume.
  2. The Nov 1 proof-of-reserves snapshot. The exchange's own reserve data already lists the drained wallets as customer-backing, meaning the shortfall will show up in reserves unless SAFU and equity-funded replenishment land first.
  3. Movement from the 19 BTC wallets. BTC has no issuer freeze; a move signals the launder begins.
  4. Formal OFAC/FBI attribution or a Treasury action — the Lazarus / TraderTraitor label currently rests on private-sector analysis.
  5. Which DeFi venues stay paused. Aave V3 Ethereum has frozen the relevant markets; Kamino paused its SOL/BTC market; others may follow if attacker addresses begin posting collateral.

Context — EIP-7702's first centralized-exchange disaster

EIP-7702 has been the subject of two kinds of writeup since Pectra: a wave of UX-flavored posts about smart-wallet batching, and a smaller strand of security papers warning that pre-signed delegations are a universal phishing primitive for any EOA that signs under a compromised session. The Binance incident is the first time the primitive has been used at centralized-exchange scale — a reminder that the hot-wallet threat model now has to include session-level signature capture, not just key theft. For comparison, the prior largest exchange hack — Bybit, February 2025, $1.46B — also traced to a compromised signing surface rather than a direct key leak. The DPRK attribution, if it holds, extends the group's tempo to roughly one nine-figure centralized-exchange breach per year.

Sources

Related stories