WORLDTECHAttacker used EIP-7702 delegation to drain Binance 14 wallet on Ethereum
Protos reports that the hack of Binance's Ethereum activity relied on EIP-7702 to target at least one address and regular transfers for others. Binance has described the incident as one of the largest heists of all time.
How the attacker drained the wallet
According to the reporting, the attacker appears to have deployed a sweeper contract and then sent 50 EIP-7702 authorizations aimed at the address labelled Binance 14, all signed with that address's key. Once the delegation was approved, the sweeper contract ran as though it were the Binance 14 account and was able to move the ether and tokens held there.
The delegation was mainly a matter of convenience for the attacker, since the signing key was already in hand. Wallets outside Binance 14 did not rely on the delegation mechanism.
Other wallets and chains moved differently
Binance 16 was able to send its hacked funds on Ethereum through an ordinary transaction rather than through this type of delegation. Several other Ethereum Virtual Machine chains, including Base, Optimism, Arbitrum, Avalanche and Polygon, also saw ordinary transfers instead of delegation.
Response and frozen funds
Binance was able to remove the delegation from Binance 14. The reporting states that approximately $2.4 billion in funds removed from Binance wallets on Ethereum have been frozen or blacklisted.
Binance itself is a cryptocurrency exchange and finance company based in the United Arab Emirates. Protos has been following the incident with live updates.
Open questions
- Who is behind the attack?
- How much of the drained value remains unrecovered?