Binance hot wallet compromised via EIP-7702 delegation abuse, draining ~$2.53B in tokens including 1.62B USDT and 167K ETH to attacker address.
Security & Exploits ·
Binance's Ethereum hot wallet containing approximately $2.53 billion in assets was drained on October 29, 2026, through exploitation of EIP-7702 delegation mechanics. The compromised wallet address lost 1.62 billion USDT, 167,000 ETH, and tokens including UNI, LINK, PEPE, ENA, wBETH, and approximately 60 other assets to an attacker collection address.
The attack involved setting an EIP-7702 delegation on the hot wallet pointing to a drainer contract, then calling a sweep function to transfer the entire token inventory. An operator-controlled EOA executed the sweep function with selector 0x8a179be4, routing all assets to the attacker address. The delegation setup required a valid signature from the wallet's private key, indicating the exchange's signing credentials were compromised.
The operator address associated with the drain had received prior funding via Tornado Cash, according to the original signal. It remains unclear whether the private key compromise resulted from operational weakness, targeted attack on exchange infrastructure, or insider access. No official statement from Binance has been documented at this time.