Binance Ethereum Wallet Drained of About $2.5 Billion

Binance’s Ethereum hot wallet Binance 14 was drained of about $2.5 billion in cryptocurrency after an attacker used an EIP-7702 authorization to delegate transaction execution to malicious code, according to blockchain analysis. The wallet transfer was part of a broader breach that Binance estimated affected about $6.3 billion in cryptocurrency across multiple networks. The authorization mechanism allowed the attacker-controlled code to move assets from the wallet in a sweep. An on-chain reconstruction described 50 authorizations signed for consecutive Binance 14 transaction nonces; one matched the wallet’s live nonce and enabled the delegation. A subsequent transaction moved about 167,464 ETH, 1.615 billion USDT and other tokens, with the assets valued at about $2.5 billion. The broader incident involved other Binance wallets and networks, with reports describing ordinary signed transfers in some cases. Binance said investigators found no evidence that wallet private keys had leaked. The exchange’s preliminary investigation initially pointed to a potentially compromised engineer’s laptop as a possible route into internal systems, but the exact path by which the attacker...