The October 29, 2025 attack exploited fifty EIP-7702 authorizations signed through Binance’s signing system rather than a flaw in the Ethereum protocol. Only one of the fifty matched the valid nonce of the “Binance 14” wallet, delegating its execution to the attacker’s contract. Three minutes and twenty-four seconds after the delegation, 167,464 ETH, $1.6 billion in USDT, and about sixty other tokens were transferred, while $780 million in USDC was withdrawn from another smart wallet. Binance says a DevOps engineer’s laptop was compromised, with no evidence of a private key leak, while TRM Labs describes the incident as a compromise of the hot wallets’ signing infrastructure. Both accounts identify an internal component authorized to sign as the weak link, one that could potentially have been stopped by allowlists, rejection rules, and transaction simulations.
Source: Read the original article
