Hackers behind the reported $6.3 billion Binance cryptocurrency theft paid approximately $15 in Ethereum network fees to set up a malicious wallet permission that enabled them to transfer around $2.5 billion in a single transaction, according to a Bloomberg report.
The attackers exploited Ethereum’s EIP-7702 feature, introduced through the Pectra upgrade in May 2025. The feature allows traditional Ethereum wallets to temporarily delegate transaction execution to smart-contract code, making it possible to bundle multiple actions and simplify wallet operations.
According to blockchain security firm Blockaid, the attackers first used a transaction to authorise malicious code to operate Binance’s hot wallet, known as Binance 14. They then used that permission to transfer approximately $2.5 billion in cryptocurrency in one transaction just three and a half minutes later.
The approximately $15 payment covered the network transaction used to establish the delegation. It was not the fee charged for transferring the $2.5 billion in assets.
The incident demonstrates how a feature designed to make cryptocurrency wallets more convenient can increase the damage when an attacker gains access to a platform’s transaction-authorisation systems.
How Hackers Used EIP-7702 to Drain $2.5 Billion
The attackers targeted Binance 14, a hot wallet used by the exchange to process customer transactions and withdrawals.
According to Bloomberg’s reporting, blockchain records examined by security researchers show that the attackers paid approximately $15 in Ethereum gas fees to establish a malicious delegation for the wallet.
At approximately 20:20 UTC on October 29, 2026, the attackers submitted an authorisation that allowed attacker-controlled code to operate Binance 14.
The initial transaction did not directly transfer the cryptocurrency. Instead, it gave the malicious software permission to execute transactions on behalf of the wallet.
Approximately three and a half minutes later, the attackers activated the code and moved around $2.5 billion worth of digital assets in a single Ethereum transaction.
The transaction included approximately 167,464 ETH and more than 60 other tokens. A significant portion of the transferred value consisted of Tether’s USDT stablecoin, worth approximately $1.6 billion.
Blockchain analysis indicated that the malicious delegation allowed the attackers to move assets much faster than executing dozens of separate transfers.
What Is Ethereum’s EIP-7702 Upgrade?
Ethereum Improvement Proposal 7702, commonly known as EIP-7702, was introduced as part of Ethereum’s Pectra upgrade in May 2025.
The feature allows externally owned accounts (EOAs), which are ordinary Ethereum wallets controlled by private keys, to temporarily use smart-contract functionality through delegated code.
Before EIP-7702, ordinary wallets generally required individual transaction authorisations and did not natively support the same programmable functionality as smart-contract wallets.
The upgrade introduced several possibilities, including:
- Transaction batching: Multiple wallet operations can be combined into a single transaction.
- Sponsored gas fees: Another party can pay transaction fees on behalf of a wallet.
- Flexible wallet permissions: Wallets can delegate certain operations to smart-contract code.
- Improved user experience: Developers can build wallet features that simplify complicated blockchain interactions.
These capabilities are intended to make Ethereum wallets easier to use and more flexible.
However, the Binance incident demonstrates a potential security risk. If an attacker obtains a valid authorisation that delegates wallet control to malicious code, the code may be able to move assets without requiring separate approval for every transfer.
Why the $15 Delegation Was So Dangerous
The key issue was not the relatively small transaction fee but the authority granted through the delegation.
The attackers did not need to pay billions of dollars in fees to move billions of dollars in cryptocurrency. They needed a valid authorisation that allowed malicious software to execute transfers from the targeted wallet.
According to blockchain analysis, the malicious program was designed to move the wallet’s assets to an address controlled by the attacker.
This approach reduced the number of separate operations required to transfer a large collection of tokens.
CoinDesk’s analysis of the Ethereum transaction records found that the attacker submitted 50 signed authorisations associated with consecutive wallet nonce values. Only the authorisation matching the wallet’s valid nonce was accepted by Ethereum.
The attacker then used the accepted permission to execute the large asset transfer.
The delegation also remained active after the initial transaction. This allowed additional transfers while the wallet continued receiving customer deposits.
The episode highlights why transaction permissions and delegated wallet functionality need to be monitored as carefully as conventional withdrawals.
Binance Hackers Continued Moving Funds After the Initial $2.5 Billion Transfer
The initial $2.5 billion transfer was only part of the wider Binance incident.
According to blockchain intelligence firm Elliptic, attackers used the malicious permission to move additional assets, including approximately $823 million from another Binance account and further funds from Binance 14.
Bloomberg’s reporting cited an estimated $3.6 billion moved using the same permission, including the initial $2.5 billion transfer.
The broader attack affected multiple blockchain networks, not just Ethereum. Binance estimated total losses of approximately $6.3 billion across the incident.
This distinction is important: EIP-7702 was involved in one major part of the attack, but it was not responsible for every stolen asset or every transaction across the affected networks.
Binance Responds by Revoking Delegation and Strengthening Security
Binance said EIP-7702 played a significant role in the incident and confirmed that it had taken steps to address the security risk.
The exchange said it had revoked the affected delegation and rebuilt the compromised wallet infrastructure.
It also introduced stricter policies for delegation-related transactions, enhanced behavioural monitoring, additional transaction-level controls and emergency procedures for revoking permissions.
Binance further said it had strengthened access controls to prevent the same attack path from being repeated.
The exchange has maintained that customer funds remain protected and that it will absorb the financial impact of the incident.
The investigation into how attackers obtained the necessary authorisations remains an important part of understanding the breach. A valid blockchain signature shows that a transaction was authorised by the relevant wallet, but does not by itself explain how the attacker obtained the ability to produce or use that authorisation.
Security Experts Say EIP-7702 Did Not Cause the Binance Hack
The role of EIP-7702 has raised questions about whether Ethereum’s upgrade itself created the vulnerability.
However, security experts have cautioned against treating the feature as the root cause of the entire incident.
Ido Ben-Natan, co-founder and CEO of blockchain security firm Blockaid, told Cointelegraph that attackers could have stolen the funds without EIP-7702. He said the feature may have allowed them to execute the transfers in one sweep and potentially bypass certain safeguards.
Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, also argued that the attackers already had the ability to authorise transactions, meaning they could have used other methods to drain the funds.
The distinction matters because EIP-7702 is a general-purpose Ethereum feature. Its intended functionality is not inherently malicious, but poorly secured delegation permissions can create serious risks.
The incident therefore raises broader questions about how exchanges review signed authorisations, simulate transactions and monitor changes to wallet permissions.
What the Binance Incident Means for Ethereum and Crypto Security
The Binance breach highlights the growing importance of wallet security beyond private-key protection.
As cryptocurrency platforms introduce programmable wallets, automated transaction systems and delegated permissions, security teams must monitor more than conventional withdrawal requests.
Several safeguards could help reduce similar risks:
- Transaction simulation: Exchanges can examine what a signed transaction will actually execute before approving it.
- Delegation monitoring: Wallets should detect and flag unexpected changes to delegated smart-contract code.
- Strict authorisation policies: High-value wallet permissions should require additional approval and verification.
- Emergency revocation: Exchanges need tested procedures to cancel suspicious delegations quickly.
- Behavioural monitoring: Unusual asset movements, especially large bundled transfers, should trigger immediate security reviews.
The incident also demonstrates that blockchain upgrades can introduce new security considerations even when their original purpose is to improve usability.
Bottom Line
The Binance attackers reportedly paid only about $15 in Ethereum network fees to establish a malicious EIP-7702 delegation that enabled them to transfer approximately $2.5 billion in a single transaction.
The feature was designed to make Ethereum wallets more flexible by allowing ordinary accounts to execute smart-contract code. In this case, attackers used the delegation mechanism to move a huge amount of cryptocurrency quickly after obtaining valid wallet authorisation.
Although EIP-7702 helped facilitate the transfer, security experts say it was not necessarily the root cause of the Binance breach. The incident instead highlights the risks of compromised signing systems, excessive wallet permissions and insufficient monitoring of delegated transactions.
Disclaimer: This article is for informational purposes only and does not constitute investment or technical security advice. The reported transaction values and attack details are based on reporting and blockchain analysis available at publication time. The investigation into the full breach remains ongoing.
Also Check: Bitwise CIO Matt Hougan Says $6.3B Binance Hack Unlikely to Have Lasting Impact on Bitcoin Price
