Ethereum’s EIP-7702 Upgrade Helped Attacker Drain $2.5 Billion From a Binance Wallet

A Binance wallet signed a permission on Thursday that let a contract controlled by the attacker operate it. Less than four minutes later, about $2.5 billion in ether and tokens was gone. That was only part of the roughly $6.3 billion Binance says was stolen across several blockchains. On Ethereum, the attacker relied on EIP-7702, a feature that went live in May 2025 with the Pectra upgrade.

What EIP-7702 Does to an Ordinary Wallet

Most Ethereum wallets, from a retail browser wallet to an exchange hot wallet, are run by a private key that signs transactions. They cannot follow rules of their own, such as spending limits or approved recipient lists. Smart contract accounts can, because they run code. EIP-7702 lets an ordinary wallet borrow that code by signing a short message called an authorization that points to a contract. Anyone can submit it to the network, and it stays active until a replacement or cancellation is recorded onchain.

Why Sweeper Scripts Were Already a Worry

The feature was meant to help everyday wallets batch payments and let others cover their fees. Within weeks of launch, market maker Wintermute found that most delegations pointed to copy-pasted sweeper scripts, which forward a wallet’s funds to a thief once its key has leaked. This time, the attacker made a Binance wallet holding billions run a sweeper of their own.

Blockchain Trail Behind the Attack

The attacker’s main wallet was funded through Tornado Cash in small withdrawals starting Wednesday. Around 16:00 UTC on Thursday, the attacker deployed a sweeper contract coded to obey only their wallet, after rehearsing on wallets of their own. At 20:20:59 UTC, a single transaction carried 50 authorizations, all signed by the wallet labeled “Binance 14” and all pointing it at the sweeper.

Why the Nonce Matters

Binance 14 keeps a counter, called a nonce, that rises with every transaction it sends. Each signed authorization must match that counter when the network processes it, which is why the attacker packed in 50 of them.