Binance hot wallets drained through a compromised DevOps laptop and EIP-7702 delegation

Entry point through a DevOps workstation

Binance's preliminary findings name a compromised laptop belonging to a DevOps engineer as the initial foothold. From that machine, the attacker reached a service container and submitted withdrawal transactions that were never authorised. The exchange has since identified further points of breach, but says it has seen no evidence that private keys leaked.

According to the reported sequence, the attacker first gained persistent access to a workstation with deployment rights and signing capabilities. Rather than compromising an existing EIP-7702 contract, the attacker used Ethereum's EIP-7702 standard to set a new authorisation. Such an authorisation is a signed message that assigns contract code to an externally owned account, so that the code runs whenever the wallet is called. In this case the primary hot wallet address, Binance 14, was delegated to a malicious contract.

Funds leave within minutes and keep moving

Three minutes after the delegation, an attacker-controlled contract called the hot wallet, executed its malicious code and moved out 167,464 ETH and $1.615B in USDT. The attacker then drained 780M USDC from secondary hot wallets, and those funds came from Hot Wallet 34, which is also owned by Binance 14.

The delegation let one attacker-controlled address empty the wallet, including new deposits, and that access was reused more than an hour later. One transaction carried 50 authorisations, so at least one would remain valid when processed. Estimates place roughly $450M of the gross outflows in ETH, with billions more in USDT and USDC.

Preparation and laundering of the proceeds

According to the reported sequence, the attacker prepared in advance by deploying a contract earlier the same day, funding through Tornado Cash and rehearsing on test wallets. Reported Bitcoin and Tron movements cannot be explained by EIP-7702.

Chainalysis reported laundering patterns it had not previously seen, with stolen funds circulating repeatedly between addresses and often returning to wallets used earlier, which may point to automation. The firm also saw the funds commingle with proceeds of last month's Bitget exploit, already attributed to North Korean actors. Reports attribute the Binance attack to the North Korean Lazarus Group, the same group behind the 2025 Bybit hack.

Scale compared with the Bybit hack

Both ends of the estimated range exceed the $1.5B Bybit hack of February 2025. Roughly $2.8B has been frozen by stablecoin issuers and others. Fireblocks' analysis of the attack path describes a structural risk common to Web3 infrastructure: signing authority reachable from privileged engineering machines without a second cryptographic boundary.

Open questions

• What is the verified total of the losses, given that Binance has not published a figure?
• Will the investigation confirm the further breach points Binance has identified?
• How much of the roughly $2.8B frozen will be recovered?