.png){kind=logo}
Binance said the October 29 security breach affected an estimated USD 6.3 billion in cryptocurrency after an attacker redirected a major Ethereum hot wallet. The exchange reported that partners had frozen roughly USD 3 billion by October 30. It also pledged to cover customer losses through its Secure Asset Fund for Users and company resources.
Blockchain security firm Blockaid traced a key part of the attack to Ethereum's EIP-7702 authorization system. One successful authorization gave a malicious contract control over the Binance 14 wallet. Meanwhile, Binance said a potentially compromised employee laptop may have enabled unauthorized withdrawal transactions.
At 20:20:59 UTC on October 29, the attacker submitted a transaction containing 50 authorizations for Binance 14, according to Blockaid. Each carried a different nonce, the counter Ethereum uses to verify an account's transaction sequence.
The values ranged from 18,914,775 to 18,914,824. Because the hot wallet kept processing withdrawals, its nonce was changing. The attacker submitted consecutive values rather than relying on one predicted counter.
Only one authorization matched. It directed the wallet to an unverified contract that allowed the attacker's address to call a function named sweep(). The function could transfer ETH and ERC-20 tokens while leaving 1 ETH for fees.
What allowed a single valid authorization to expose a wallet handling billions in assets? EIP-7702 lets a standard Ethereum account delegate execution to smart contract code. That delegation can remain active after the first transfer, exposing later deposits until the account revokes it.
At about 20:24 UTC, the attacker took assets worth roughly USD 2.5 billion from Binance 14. The transfers included 167,464 ETH, more than 1.6 billion USDT and dozens of other tokens.
In its October 30 update, Binance said investigators suspect an attacker accessed a DevOps engineer's laptop. That access may have opened an internal service container capable of submitting withdrawal transactions.
The exchange said it had found no evidence of a leaked wallet private key. Still, investigators had not determined how the attacker obtained the authorizations. Binance confirmed that it revoked the affected wallet authorization.
Blockaid found that the attacker funded an operating address through three Tornado Cash withdrawals before the breach. The attacker also deployed the malicious contract several hours before targeting Binance 14.
Other transfers involved Binance 16 and an Ethereum wallet holding USDC. The wider operation reached Bitcoin, Tron, Arbitrum and Avalanche, as funds moved beyond the initial Ethereum wallet.
Earlier EIP-7702 incidents showed similar risks. One October 14 attack on a compromised Ethereum account resulted in a loss of approximately USD 22,770 in ETH.
Read More: Binance Faces USD 5.57 Billion Wallet Outflow: USD 1.8 Billion Stablecoins Frozen
Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT linked to the suspected breach. Circle CEO Jeremy Allaire separately reported freezing over 800 million USDC alongside law enforcement coordination.
Ripple executive Jack McDonald said the company was working to restrict affected RLUSD holdings. Arbitrum's Security Council also moved 74,559,805 ARB and 8,425 ETH into a restricted intermediary wallet.
Binance temporarily suspended deposits and withdrawals during security checks. Co-founder Yi He later said deposits were operating normally and expected withdrawals to resume within 48 hours, while address controls underwent improvements.
Founder Changpeng Zhao said, “User funds are safe!” He added that he no longer managed Binance but expected customers to receive full coverage. Binance's U.S. affiliate said the incident had not affected its operations.
Binance said it would publish an updated Proof of Reserves after remediation and a technical post-mortem after its investigation. The exchange continues working with law enforcement and blockchain intelligence firms to trace affected assets
The October 29 Binance breach affected an estimated USD 6.3 billion and involved a malicious EIP-7702 wallet delegation, according to Binance and Blockaid. Issuers and blockchain partners froze roughly USD 3 billion. Binance says it will cover customer losses while investigators establish how the attacker accessed internal systems.