An attacker moved about $6.4 billion from Binance wallets across 10 blockchains on October 29, 2026, according to the source. TRM Labs and Chainalysis attributed the theft to the North Korean hacking group TraderTraitor. On Ethereum, the attacker used EIP-7702 to make a Binance hot wallet run attacker-controlled code and sweep its assets.
EIP-7702 requires a valid signature from the wallet being delegated. Binance wallets on the other nine chains sent funds through ordinary signed transfers, which TRM Labs said points to compromised hot-wallet signing infrastructure rather than a flaw in Ethereum. Binance said its investigation began with a compromised engineer’s laptop and later found additional breaches.
Activated on May 7, 2025, EIP-7702 lets standard Ethereum wallets use smart-contract code for features such as batched transactions. That delegated code has full access to the wallet’s funds.
