Binance Breach: How a Single Wallet Authorization Drained Billions

Blockchain security firm Blockaid discovered that the perpetrator submitted 50 simultaneous EIP-7702 authorizations in a single transaction. By flooding the network with consecutive nonce values, the attacker ensured that one authorization would successfully link the Binance hot wallet to a malicious smart contract. This contract enabled an unauthorized sweep function, draining assets including 167,464 ETH and over 1.6 billion USDT.

Binance investigators believe the entry point was a compromised DevOps engineer’s laptop, which may have granted access to an internal service container. Despite the scale of the theft, the exchange confirmed no private keys were leaked. To mitigate the damage, Tether and Circle froze approximately $2.3 billion in assets, while Binance reported a total of $3 billion blocked across various networks, including Arbitrum and Avalanche.

Co-founder Yi He stated that while withdrawals were temporarily paused for security hardening, user funds remain protected by the Secure Asset Fund for Users (SAFU) and corporate reserves. The exchange expects to resume standard operations within 48 hours as it continues to trace how the attacker secured the necessary authorizations for the redirect.