Binance Ethereum Hot Wallets Drained of Over $5.5 Billion via EIP-7702 Delegation Attack
On October 29, attackers drained between $2.5 and $3.5 billion in ETH from Binance hot wallets on Ethereum within 40 minutes, with total losses across Bitcoin and Tron reaching at least $5.57 billion according to Decrypt. The attacker did not steal private keys directly but used EIP-7702 to delegate control of Binance 14 to a malicious contract containing a sweep function that transferred ETH and 63 tokens in a single call. Tether and Circle froze approximately $2.5 billion in USDT and USDC within hours, while Binance stated user funds remain secure. On-chain analysis reveals 18 hours of preparation including three test delegations funded via Tornado Cash, followed by the main delegation and sweep executed in just over three minutes. The attack shares strong operational similarities with previous incidents attributed to TraderTraitor, a subgroup of the North Korean Lazarus group, including gas funding patterns, test runs, and the use of a sweep function. Nearly $1.8 billion in stablecoins was frozen in the first hour, though 195,460 ETH moved to an unmoved address at 0x8532…43D4.
HabrOct 29, 2026Translated from Russian