Hackers drain $6.3 billion from Binance via Ethereum flaw
Binance has acknowledged a security incident on its crypto exchange, with the total financial impact estimated at approximately $6.3 billion. The exchange reported that a preliminary investigation indicates a compromised DevOps engineer’s laptop enabled an attacker to access a service container, facilitating the submission of unauthorized withdrawal transactions.
The breach occurred through a flaw in Ethereum’s EIP-7702 authorization system, according to blockchain security firm Blockaid. The attacker exploited a hot wallet labeled Binance 14, using 50 signed authorizations to delegate control to an unverified sweeper contract. Only one authorization matched the wallet’s active transaction nonce, granting the attacker access. Minutes later, the wallet was emptied of $1.6 billion in USDT, 167,464 ETH, and over 60 other tokens.
Blockaid’s analysis shows the broader outflow across Ethereum, Bitcoin, and Tron totals at least $5.57 billion from Binance-linked wallets. The firm noted that the signatures were produced using the wallet’s private key, suggesting a compromise of signing infrastructure rather than a direct key leak. Ido Ben-Natan, CEO of Blockaid, described the attack pattern as “very, very similar” to the 2025 Bybit hack, which saw $1.5 billion in Ether stolen.
Binance’s Recovery Plan and User Assurances
Binance has stated it will cover all losses from its SAFU fund and company funds, assuring users that their funds remain safe. The exchange has temporarily suspended deposits and withdrawals to complete security checks, revoked the affected address authorization, and engaged law enforcement and blockchain intelligence partners to trace and recover funds. It also plans to publish an updated Proof of Reserves once remediation is complete.
While Binance claims no evidence of wallet private key leaks, the exchange has not explained how user funds remain “completely safe,” as cited in on-chain commentary. The breach follows a £150 million UK lawsuit against Binance from retail traders in July, as well as its expansion into offering access to 7,000 US stocks in June. The timeline for resuming operations or publishing a detailed technical post-mortem has not been provided.
Record Breach: How This Attack Outpaces Past Hacks
The attack marks the largest crypto theft on record, surpassing the Bybit breach earlier this year. Binance’s response—freezing assets, engaging law enforcement, and covering losses—mirrors measures taken after previous high-profile incidents, though the scale of this breach remains unprecedented.
Blockchain forensics firm Blockaid confirmed the attacker used a Tornado Cash-funded operator address to drain the wallet. The sweeper contract installed on the hot wallet could only be operated by that address, further isolating the breach’s origin. Binance’s internal investigation remains ongoing, with no timeline for resuming deposits and withdrawals.
The attacker’s method relied on Ethereum’s EIP-7702 authorization system, which allows wallets to delegate control to smart contracts via signed permissions. Each authorization works only for a specific transaction nonce, the sequential number assigned to each transaction from a wallet. Since Binance’s hot wallet was still active, the attacker did not know which nonce would be next, so they submitted 50 authorizations in a single transaction, covering a range of possible nonces. One of those matched the wallet’s live nonce, granting control to the sweeper contract. Blockaid noted that the contract’s operator address had been funded through Tornado Cash, a privacy-focused mixer, making it harder to trace the funds’ origin.
