Hoskinson highlights EIP-7702 security risks following Binance incident

The analysis, published by an account known as CyberSatoshi, reconstructs bytecode allegedly used to sweep assets from a Binance hot wallet. According to the report, the attacker submitted 50 pre-signed authorizations covering consecutive transaction nonces. This technique effectively allowed the malicious contract to maintain control as the account’s transaction count shifted, enabling the drain of assets while leaving exactly 1 ETH to prevent automated gas-failure alerts from triggering within the exchange’s infrastructure.

Central to the controversy is EIP-7702, an Ethereum specification that allows externally owned accounts to delegate execution to smart-contract code. While the feature offers legitimate benefits like transaction batching and fee delegation, it grants the delegate code unrestricted access to the authorizing account. CyberSatoshi notes that the attack required access to Binance’s signing credentials, yet emphasizes that the delegation mechanism allowed the attacker to compress complex asset transfers into a single, high-speed operation. The contract purportedly included a loop designed to bypass unresponsive or blacklisted tokens, ensuring the sweep continued even if individual transfers failed. Furthermore, the attacker allegedly leveraged the compromised wallet to interact with an external vault holding $823 million in USDC, exploiting the vault’s recognition of the Binance wallet as an authorized controller.