Binance CEO CZ confirms the exchange will cover all user funds following an escalating incident involving EIP-7702 delegation exploit and potential compromise of Binance's 16-of-N signing key.
Security & Exploits ·
A Binance security incident has escalated beyond an initial EIP-7702 delegation exploit to involve potential compromise of the exchange's signing key infrastructure. The incident began as what appeared to be a delegation vulnerability but has broadened into questions about the integrity of Binance's core signing systems, with one signing key reported as compromised. Binance leadership has committed to covering all user funds affected by the breach.
The attack exploited EIP-7702 delegation mechanics to drain approximately $201 million from a Binance hot wallet, with the attacker extracting USDT, ETH, and other major tokens through operator-gated sweep functions. The compromise extended to at least one of Binance's 16 signing keys, suggesting the attacker gained access to critical infrastructure beyond what a standard delegation exploit would enable. Ripple has frozen approximately $200 million in assets linked to the incident, as reported by Binance co-CEO Yi He.
Key uncertainties remain about the full scope of affected signing infrastructure, how the attacker obtained access to the signing key, and whether additional systems are at risk. The distinction between the delegation vulnerability and potential key compromise represents a material escalation in severity and may require substantive changes to Binance's custody or signing architecture to prevent recurrence.