On the evening of 29 October, between $2.5 billion and $3.5 billion in assets left Binance hot wallets on the Ethereum network in roughly 40 minutes. When Bitcoin and Tron movements are included, total losses reach at least $5.57 billion according to Decrypt calculations.
The attacker did not extract private keys. Instead, the operation relied on EIP-7702 to replace the code executed by Binance 14 with a malicious contract. A single signed authorization allowed the wallet to run attacker-controlled logic that swept ETH and 63 tokens to an external address in one transaction.
18-hour preparation visible on-chain
Blockchain records show the attacker prepared for nearly 24 hours and conducted three rehearsal attacks on unrelated wallets. Gas was pre-funded through three deposits of approximately 0.1 ETH each from Tornado Cash on 28 and 29 October.
- 02:29 UTC — deployment of the first contract
- 13:51 UTC — EIP-7702 delegations to two test wallets followed by sweep tests
- 15:59 UTC — deployment of the final malicious contract 0x63e8…6fAe later used against Binance
- 16:21–16:30 UTC — third test on another wallet
- 20:21 UTC — EIP-7702 delegation of Binance 14 to the attacker contract
- 20:24 UTC — main sweep of 167,464 ETH and 63 tokens, including roughly 1.615 billion USDT
Three and a half hours separated the final test from the live attack. The interval between delegation and the first large withdrawal was only 3 minutes 24 seconds.
How EIP-7702 enabled the theft
EIP-7702 permits an externally owned account to adopt the code of a smart contract after the account owner signs an authorization. From that moment, every call to the address executes the delegated code. The attacker deployed a contract containing a sweep(address pool, address[] depositors) function that transferred ETH and listed tokens to a chosen recipient. A type-4 transaction containing the signed authorization was sent at 20:20:59 UTC. Three minutes later the sweep function was invoked directly on Binance 14, moving assets with a gas cost of roughly 0.0004 ETH.
Subsequent calls to a second function on Binance 14 coincided with withdrawals of 780 million and 43 million USDC from Hot Wallet 34, indicating the attacker leveraged permissions held by Binance 14 over that contract.
Fund movements and freezes
Tether and Circle froze approximately $971 million USDT and $823 million USDC in the first hour. By 01:09 Moscow time Tether had increased its freeze to roughly $1.67 billion, bringing the combined frozen amount to about $2.5 billion. The primary recipient address 0x5227…2f8c still held around 971 million USDT and 2,077 ETH at the time of analysis. Another 195,460 ETH moved in a single transaction to 0x8532…43D4 and remained unmoved. Smaller amounts of RLUSD, UNI, PEPE, wBETH and ENA were distributed to fresh wallets pre-funded with 0.5–1 ETH for gas.
Attribution and defensive lessons
Official attribution has not been published, yet the operational profile closely matches previous operations linked to TraderTraitor, a subgroup of the North Korean Lazarus group. Similarities include Tornado Cash gas funding, multiple test runs, rapid contract deployment, and use of a sweep function. Binance had previously reported blocking a series of Lazarus-linked attacks via fake job interviews days before the incident.
Key defensive recommendations include blocking EIP-7702 authorizations on service wallets, monitoring type-4 transactions, and implementing rapid revocation of delegations. The incident demonstrates that stablecoin freezes can recover substantial value, while native ETH remains difficult to halt once moved.
