Ethereum · CoinDesk
Here’s how an Ethereum upgrade helped drain part of Binance’s $6 billion loss
Compiled by KHAO Editorial — aggregated from 1 source. See llms.txt for citation guidance.
★ Tier-1 Source
A Binance wallet signed a permission on Thursday that let an attacker-controlled contract operate it.
Key facts
- The attacker also used Binance 14's borrowed code to give orders to a separate Binance smart wallet, Hot Wallet 34, and pulled 823 million USDC out of it, TRM Labs said
- At 20:24:23 UTC, the attacker called the sweeper through Binance 14
- At 20:20:59 UTC, the attacker sent one transaction
- On Ethereum, the attacker used a feature called EIP-7702, named for its Ethereum Improvement Proposal number
Summary
An attacker used Ethereum’s EIP-7702 feature, which lets ordinary wallets run smart-contract code, to drain about $2.5 billion from a Binance wallet in less than four minutes on Thursday. The attacker obtained valid signatures authorizing malicious code that remained active for nearly four hours, allowing further thefts as customer deposits continued arriving. Binance put losses across several blockchains at $6.3 billion and pledged to cover them, while investigators continue examining how the attacker obtained authorization to move the funds. That was only part of the roughly $6.3 billion Binance says was stolen across several blockchains.