Binance hot wallets drained through a signed EIP-7702 delegation

At 20:24 UTC the contract moved 167,464 ETH and 63 tokens to a new address in one transaction, for a fee under one US dollar. Transfers from a second hot wallet and in USDC, USDT, Bitcoin and Tron followed within the hour.

The deploying address was funded on 28 October with 0.1 ETH from the Tornado Cash mixer.

Binance suspended deposits and withdrawals on several networks and is working with law enforcement. Co-founder Yi He said user funds are safe, that Binance will bear all losses, and that a full post-mortem will follow. Binance.US said it was not affected.

Binance has not published a loss figure. Each number below is an estimate from the source named.

EIP-7702 lets an Ethereum account delegate its behaviour to a smart contract. A delegation signed with the account's own key lets that code move everything the account holds.

TRM Labs assesses that the attacker could make Binance's hot-wallet signing system sign transactions of its choosing, across every chain hit. It attributes the theft to TraderTraitor, the North Korean unit the FBI named for the US$1.4 billion Bybit theft in February 2025. Binance has not confirmed either.

Few Australian businesses run an exchange hot wallet. Many hold an equivalent: a payment approval in internet banking, a code-signing certificate, a cloud administrator role or a treasury wallet. One valid approval moves money or ships code, and the system checks the signature is valid and nothing more.

Binance's post-mortem should settle the entry point and the final loss. Until then, treat any message about Binance refunds, compensation or recovery services as a likely scam. Binance has told users not to trust unofficial links, messages or requests for account details.