Hackers used an Ethereum upgrade in the $6.4B Binance theft
Analysts say the attacker used EIP-7702 to drain a Binance hot wallet, but the breach points to Binance's own signing systems.
The facts
- According to Decrypt, an attacker moved some $6.4 billion out of Binance wallets on 10 blockchains on October 29, 2026, most of it within about 20 minutes.
- TRM Labs and Chainalysis both attributed the theft to TraderTraitor, a North Korean hacking group. Attribution comes from the analytics firms, not a court or government.
- On Ethereum, TRM Labs says the attacker used 50 pre-signed EIP-7702 authorizations to turn a Binance hot wallet into a sweeper. Funds on the other nine chains moved through ordinary signed transfers.
- Binance says the investigation began with a compromised engineer's laptop and has since found "additional points of breach."
Case notes · Danny's take
Why it matters
EIP-7702 is a useful upgrade. It lets ordinary wallets borrow smart contract features like batched transactions and sponsored fees. But the same trick hands delegated code full access to the funds. Here the chain did what it was told: the delegation needed a valid signature, so the real failure was keys and infrastructure. Not the protocol. The people holding the keys.
For traders
Don't trade the headline or the attribution. Watch Binance's own updates on the breach, what it says about user funds, and whether the stolen assets move through mixers or exchanges. Treat the $6.4 billion figure as the source's number until the exchange confirms the final loss.
For builders
If you build wallets or custody tools, treat any prompt to sign a 7702 delegation as high risk, as the specification itself warns. Lock down hot wallet signing infrastructure and the laptops of the engineers who touch it. The breach started on one engineer's machine, and no smart contract audit covers that.
Not financial advice. Do your own investigation.
This story was summarised with AI from Decrypt's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.