Binance exploit tied to EIP-7702 delegation, preliminary losses mount
A signed EIP-7702 delegation is at the center of the Binance security incident, with Fireblocks saying the attack path allowed withdrawals from hot wallets across multiple blockchains and Binance’s own preliminary update pointing to a potentially compromised DevOps laptop. The published material suggests a fast-moving breach with losses still being tallied and key facts not yet finalized.
What the source material says
In a report published on 2026-10-30, Fireblocks said attackers drained Binance hot wallets on 2026-10-29 and that gross outflow estimates run from $3.3 billion to $6.3 billion, including roughly $450 million in ETH and billions in USDT and USDC. Fireblocks also said roughly $2.8 billion was frozen by stablecoin issuers and others, while Binance has not published a verified total loss figure. The report said the first sweep landed within minutes and activity continued for more than an hour.
Binance’s own preliminary incident update, also dated 2026-10-30, says the exchange is investigating a potentially compromised DevOps laptop, access to a service container and unauthorized withdrawal submissions. It says deposits remain unaffected and promises a technical post-mortem. The update does not establish a finalized root cause.
How the attack path was described
Fireblocks said the reported sequence began with a workstation compromise that gave an attacker access to deployment and signing capabilities. It then describes an EIP-7702 delegation being injected into Binance 14, a primary hot wallet address, and an attacker-controlled contract executing within about three minutes to transfer out 167,464 ETH and $1.615 billion in USDT. The report says 780 million USDC was then drained from secondary hot wallets tied to Binance 14, and that Binance 16 was also targeted. Activity reportedly spanned Ethereum, Arbitrum and Avalanche.
The same report says the attacker prepared a contract earlier that day, used Tornado Cash for funding and rehearsed the process on test wallets. It also says one transaction carried 50 authorizations, so at least one would be valid when processed. Fireblocks states that the delegation allowed one attacker-controlled address to drain the wallet, including new deposits, and that the access was reused more than an hour later.
What remains unconfirmed
Fireblocks says reports attribute the attack to the North Korean Lazarus Group, the same actor linked in reporting to the 2025 Bybit hack. That attribution remains part of the source material rather than a finalized finding in Binance’s preliminary notice. The material also says reported Bitcoin and Tron movements cannot be explained by EIP-7702 alone, underscoring that separate chain-specific evidence would be needed before drawing conclusions about those transfers.
The source material also notes that community reports described the sweep timing and batch of 50 authorizations, but says those transaction details were not independently verified against full transaction hashes in the research. As a result, the reported mechanism is best read as a preliminary technical explanation, not a final post-mortem.
Why the incident matters
Fireblocks frames the event as a structural risk: signing authority reachable from privileged engineering machines without a second cryptographic boundary. Its report argues that a single developer or DevOps endpoint should not have unilateral authority to deploy or alter wallet permissions, and it points to controls such as enclave-backed deployment environments, multi-party approvals, least-privilege access, balance caps and real-time anomaly detection.
The report also says Fireblocks’ security posture tools are intended to surface misconfigurations, risky policies and excessive permissions, and that controls around raw signing, delegation limits and policy enforcement are meant to reduce the blast radius of a compromised endpoint. Those are controls described by the vendor in the context of the incident, not independently verified guarantees against future attacks.
Binance’s later update on 2026-10-30 says the exchange will cover hacked losses with company funds, and related Binance messaging says $6.34 billion was reserved and $5 billion was already held in the affected tokens. The timing and accounting details in those statements are separate from the incident’s technical root cause, which remains under investigation.