Binance's $6.34B Breach Exploited Developer Compromise and EIP-7702 Flaw

On Oct. 29, attackers drained approximately $6.34 billion from at least 11 Binance wallets by exploiting EIP-7702, an Ethereum smart account feature introduced in 2025. They deployed sweeper code that transferred funds from Binance’s primary treasury wallet—containing over $2.5 billion in various cryptocurrencies—leaving only a single ETH coin. EIP-7702 authorizations function as standing delegations with no amount or destination limits, making them invisible to standard withdrawal controls once established on-chain.

The breach originated with developer compromise. Attackers compromised three Binance developers—one through a corrupted Homebrew installation, another via social engineering during a fake job interview with a malicious software assignment—to gain signing privileges. They created 50 presigned authorizations and used a nonce spray attack, submitting all simultaneously to ensure at least one would execute. Despite Binance’s countermeasures, the authorization continued operating for approximately four hours (20:05 UTC to 23:56 UTC). The company discovered that suspending withdrawals and shutting down hot wallet services did not invalidate existing on-chain authorizations, requiring explicit revocation transactions. The FBI attributed the attack to North Korean operators behind TraderTraitor, publishing over 600 associated Ethereum addresses. Binance recovered approximately $2.85 billion in attempted stolen assets.