Skip to content

Back to the catalog

How the Binance hack happened on-chain on Ethereum
protos.comarticle

How the Binance hack happened on-chain on Ethereum

Protos analysis of how the Binance hack played out on Ethereum. The attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations for the Binance 14 hot wallet, signed with its key and using varied nonces to match the wallet's changing count. Other wallets and EVM chains used plain transfers. Binance later removed the delegation, and about $2.4 billion in funds was frozen or blacklisted.

TL;DR Explains how attackers used a stolen Binance 14 key and EIP-7702 delegation to a sweeper contract to drain Ethereum funds.
Open original ↗

Organisations named here

  • Binance

Technologies named here

  • Ethereum
  • Polygon
  • Arbitrum
  • Avalanche
  • Base
  • Binance 14 (Binance hot wallet address on Ethereum)
  • Binance 16 (Binance wallet address on Ethereum)
  • Optimism

Standards and laws named here

  • EIP-7702

Techniques named here

  • Direct transfers with compromised keys
  • EIP-7702 delegation abuse
  • Nonce matching in authorizations
  • sweeper contract

Concepts named here

  • Delegation as a convenience
  • EIP-7702 wallet delegation
  • Hot wallet
  • Nonce

Threat actors named here

  • Binance hack attacker (unnamed; deployed a sweeper contract and signed with the Binance 14 key)

Related in Blockchain