Overview
- Blockchain analysts say the incident began on Oct. 29 when a single Ethereum type-4 transaction carried 50 pre-signed EIP-7702 authorizations and one matched the live nonce for Binance 14, enabling delegation to attacker code that executed a large initial sweep.
- The first major transfer moved about 167,464 ETH plus roughly 1.6 billion USDT and dozens of tokens, which analysts value near $2.5 billion, and delegation persisted so the attacker made further moves across Ethereum and other chains.
- Binance estimates about $6.3 billion was affected and reports roughly $3 billion of those assets have been frozen by the exchange and partners, with Tether and Circle accounting for about $2.54 billion of freezes.
- Binance’s preliminary probe points to a possibly compromised DevOps engineer laptop as the source of signing access and the company says it has found no evidence that raw private keys were leaked; formal investigations and a promised technical report are still under way.
- Independent researchers reconstructed a bespoke 'sweeper' contract that allegedly left 1 ETH to avoid alerts, looped token transfers, and could reach external vaults, highlighting that EIP-7702 lets signed delegate code run with broad account privileges and that signing controls and delegate audits are now central policy questions.