TLDR
- Binance says attackers stole about $6.3 billion across several blockchains, the largest hack in crypto history.
- On Ethereum, the attacker used the EIP-7702 feature to drain about $2.5 billion in under four minutes.
- Security firms say the upgrade did not cause the hack but may have helped attackers bypass checks.
- Binance’s co-CEO Richard Teng said early findings point to a compromised engineer’s laptop, and more breach points were later found.
- Binance has pledged to cover all losses and says about $3 billion of the assets have been frozen.
Binance confirmed on Friday that it lost about $6.3 billion in a hack that hit several blockchains. The exchange called it the largest theft in crypto history. It has pledged to cover all losses.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
— Binance (@binance) October 30, 2026
On Ethereum, the attacker used a feature called EIP-7702. It went live in May 2025 as part of the Pectra upgrade. About $2.5 billion in ether and tokens left a Binance wallet in less than four minutes on Thursday.
How the Ethereum attack worked
Most Ethereum wallets are controlled by a private key. They cannot follow rules like spending limits. EIP-7702 lets an ordinary wallet borrow code from a smart contract by signing a short message called an authorization.
How the Binance hack worked:
The attacker exploited EIP-7702 – an Ethereum Pectra upgrade
That lets a regular wallet temporarily act as a smart contract with a valid private key signature.
Hacker pre-collected 50 EIP-7702 authorizations with sequential nonces
Not knowing the… https://t.co/BYQdcYtUb7 pic.twitter.com/Cq5lv8Qwc7
— philarekt (@philarekt) October 29, 2026
The feature was built to help wallets batch payments and let others cover fees. Within weeks of launch, trading firm Wintermute found that most early delegations pointed to “sweeper” scripts. These scripts forward a wallet’s funds to a thief.
The attacker funded their main wallet through Tornado Cash starting Wednesday. They tested the plan on their own wallets and deployed a sweeper contract at about 16:00 UTC Thursday. The contract only let the attacker’s wallet operate it.
At 20:20 UTC, the attacker sent one transaction with 50 authorizations. Each was signed by a wallet labeled “Binance 14” on Etherscan. Each carried a different transaction counter value, so one would match as the wallet kept sending withdrawals.
Ethereum accepted the authorization numbered 18,914,809 and ignored the other 49. At 20:24 UTC, the attacker moved about 167,464 ETH and 63 tokens. That included roughly 1.6 billion USDT.
The attacker swept more customer deposits from the wallet at 21:04 and 21:44 UTC. The attacker also used the wallet to order a separate Binance wallet to send out 823 million USDC, according to TRM Labs. Binance 14 revoked the permission at 00:10 UTC Friday, nearly four hours later.
What experts say about the cause
The theft went beyond Ethereum. The attacker also moved 18,270 bitcoin, hundreds of millions of XRP, and funds on Solana and Tron. Those networks do not use EIP-7702, and the funds left through ordinary signed transfers, TRM Labs said.
Richard Teng said early findings pointed to a compromised DevOps engineer’s laptop. He said the attack was not a single “one-click” action. He also said there was no evidence that private keys leaked.
Binance later said investigators found more breach points. It did not name them or explain how the attacker got the signatures.
Ido Ben-Natan, CEO of security firm Blockaid, said attackers could have stolen the funds without EIP-7702. He said the upgrade let them do it in one sweep and may have helped bypass some checks. Ivo Georgiev, CEO of wallet provider Ambire, said the feature made little difference because the hackers could already authorize transactions.
Binance said about $3 billion of the affected assets have been frozen. It plans to use its SAFU emergency fund and company funds to cover the losses. The full attack path has not been published.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
