The largest single transfer in last week’s Binance hack started with about $15 in Ethereum network fees, security firm Blockaid says. That small payment switched on a permission that let attacker-controlled code act for one of Binance’s hot wallets. Minutes later it moved about $2.5 billion in one transaction.
The permission comes from EIP-7702, a feature added to Ethereum in the Pectra upgrade in May 2025. It lets an ordinary wallet temporarily run smart-contract code, which is useful for things like batching payments. On October 29, a Binance wallet known as Binance 14 signed authorizations pointing at an attacker’s “sweeper” contract. Once the delegation was live, the contract emptied the wallet: about 167,464 ETH and more than 60 other tokens, including roughly $1.6 billion in USDT.
The delegation stayed active for nearly four hours, so new customer deposits routed into the wallet were swept too. Binance revoked it just after midnight UTC.
The signatures were valid. Binance says there’s no evidence its private keys leaked, and preliminary findings pointed to a compromised engineer’s laptop, with other breach points found since. Binance puts total losses across several blockchains at $6.3 billion, says it will cover them from its SAFU emergency fund and company money, and said about $3 billion of the affected assets had been frozen.
The lesson for ordinary users is simple: a wallet permission can be worth more than the coins it guards. Check which contracts your wallet has approved or delegated to, revoke the ones you don’t recognize, and treat any request to sign an authorization as seriously as a request to send money.