An attacker exploited Ethereum's EIP-7702 account abstraction feature to convert Binance hot wallet Binance 14 into an attacker-controlled smart-account sweeper, enabling a single transaction to move about $2.5 billion in ETH and tokens during a broader $6.4 billion multi-chain breach on October 29–30, 2026.
According to on-chain reconstructions by TRM Labs and Chainalysis, at 20:20:59 UTC the attacker submitted a type-4 transaction containing 50 authorizations signed for consecutive Binance 14 nonces. One matched the live nonce and delegated the wallet to malicious contract code. About three minutes later, a sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT, in one transaction. The attacker address had previously received gas funding and deployed the malicious contract.
EIP-7702, activated through the Pectra upgrade in May 2025, lets externally owned accounts temporarily execute smart-contract code after signing an authorization. It was designed by Vitalik Buterin and other developers to enable batching, gas sponsorship and limited-permission keys. However, delegated code can have unrestricted access to account funds. The specification warns wallets should never provide an interface for signing such authorizations. Within weeks of Pectra, Wintermute found that more than 80% of EIP-7702 delegations pointed to copies of a malicious sweeper contract.
On other affected chains, wallets signed ordinary outgoing transfers, including activity on Bitcoin, Tron and additional networks. Binance said its preliminary investigation pointed to a compromised DevOps engineer laptop that may have provided access to a service container, with no evidence of a private-key leak. The exchange paused withdrawals during security checks and later said it found additional breach points. Binance placed the broader impact near $6.3 billion, with roughly $3 billion frozen.
TRM Labs and Chainalysis attributed the theft to the North Korean TraderTraitor group, also responsible for the $1.5 billion Bybit hack in February 2025. Researchers emphasized that EIP-7702 required valid signatures and amplified the damage by enabling an atomic sweep, but did not cause the initial compromise. Investigators are now focused on Binance's signing environment and access controls.
The incident has renewed attention on Ethereum's account abstraction roadmap. EIP-7702 is viewed as a first step toward full account abstraction, with EIP-8141 proposed for the Hegotá upgrade as a potential next milestone.
