Binance hot wallet drained of ~$201.2M via EIP-7702 delegation abuse and private key compromise, with attacker using operator-gated sweep function to extract USDT, ETH, and major tokens.
Security & Exploits ·
Binance's Ethereum hot wallet experienced a significant drain on October 29, 2026, with approximately $201.2 million in assets extracted through a combination of EIP-7702 delegation abuse and private key compromise. The attack targeted wallet 0x28c6…1d60, which had been set up with an EIP-7702 delegation pointing to an operator-controlled contract. The attacker then invoked a sweep function to transfer 200.40 million USDT, 369.8 ETH, and multiple other tokens including LINK, UNI, AAVE, and COMP to a collection address.
The mechanics reveal a two-stage compromise. Setting up an EIP-7702 delegation requires a cryptographic signature from the account owner, indicating the exchange's private key had been compromised. Once delegated, the attacker operator—distinct from the wallet owner—called an operator-gated sweep function encoded in the delegated contract code, which automatically transferred the wallet's entire inventory to attacker-controlled addresses in a single transaction.
The incident appears part of a larger campaign, with corroborating reports suggesting potential compromise of multiple Binance signing keys and sweeps totaling approximately $2.5 billion across several transactions. The exact scope of affected wallets and the timeline of key compromise remain under investigation.