At about 20:20 UTC on October 29, Binance's hot wallet "Binance 14" was given an EIP-7702 delegation pointing to an attacker-deployed contract. About three minutes later, roughly 167,000 ETH, about 1.6B USDT and more than 60 other assets left in a single transaction, and around 28,000 ETH left a second hot wallet. Estimates of the total outflow range from about $2.8B to $3.5B.
Tether, Circle, Ripple and others froze funds quickly. Binance says $2.54B is now verified frozen, has suspended deposits and withdrawals, and says it will cover all losses and publish a full post-mortem. Binance has not confirmed whether the delegation came from a stolen key or a compromised signing system. According to researchers, the delegation stayed active for nearly four hours, and an incoming transfer of about 2,961 ETH was also swept in that window.
Where small teams are exposed
Process
EIP-7702 authorizations have only existed since May 2025. Most teams' signing services, MPC policies and review checklists look at transfers and contract calls, and do not treat a delegation authorization as a high-risk action.
Risk
Once an address is delegated to a malicious contract, the attacker no longer needs a signature per transfer. One transaction can empty every token in the address, and the delegation stays live until revoked, so deposits that keep arriving are swept too.
Privileges
Hot wallets often hold far more than daily withdrawals require. When one address falls, the loss is its whole balance. Most of this loss was recovered only because stablecoin issuers could freeze; ETH and most tokens cannot be frozen.
Five things you can do now
- Make your signing service and MPC policy reject EIP-7702 authorizations by default. Where you truly need them, allow only allowlisted contracts and require multi-person approval
- Monitor every hot wallet and sweep address for a delegation being set (the address suddenly has code). Alert immediately, retire the address and reroute deposits
- Cap hot wallet balances at what daily withdrawals need, and sweep the excess to cold storage or a multisig on a schedule. Keep stablecoins and native assets in separate addresses
- Write a "hot wallet compromised" runbook: who can halt deposits and withdrawals, how to revoke a delegation, how to switch addresses. Keep contact routes to stablecoin issuers and major exchange security teams ready in advance
- Review every machine, person and third-party service that can reach hot wallet signing, and keep signing request logs somewhere tamper-proof for the post-mortem
Times, amounts and transactions come from onchain records and public reporting, and estimates vary. Frozen amounts, the deposit and withdrawal suspension and loss coverage come from Binance's official statements. The root cause (stolen key or compromised signing system) has not been confirmed; Binance's post-mortem will be the reference. This article does not cover attack details.
Sources
- Binance: $2.54B verified frozen (2026-10-29) ↗
- Binance: will cover all losses, deposits and withdrawals suspended (2026-10-30) ↗
- Tether froze over 1.567B USDT / Circle froze over 800M USDC (shared by CZ) ↗
- Cryptoticker: Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702 ↗
- Odaily: EIP-7702 developer on the Binance incident (Chinese) ↗
Also on X · Oct 30, 2026: View the original post on X ↗
