In what has swiftly materialized as the largest security breach in the history of the cryptocurrency industry, Binance has confirmed a staggering $6.3 billion exploit. According to prominent blockchain security firm Blockaid, the unprecedented heist was likely facilitated by compromised signing systems, while Ethereum’s recently implemented EIP-7702 upgrade may have acted as a force multiplier, allowing attackers to efficiently bypass routine security checks and drain funds in a single, clean sweep.
The massive security failure came to light when Binance officially verified the $6.3 billion loss on Friday, concurrently pledging to cover all affected user funds out of its own reserves. Initially, internal investigations pointed toward a compromised laptop belonging to one of the exchange’s engineers. However, as the scope of the forensic analysis widened, Binance revealed that it had uncovered additional points of breach within its operational network, indicating a far more sophisticated and coordinated attack vector than a simple localized endpoint compromise.
Ido Ben-Natan, the co-founder and chief executive officer of Blockaid, noted that while the attackers could technically have executed the theft
without relying on Ethereum’s EIP-7702 upgrade, the mechanism drastically streamlined their operational execution. Speaking to industry reporters on Friday, Ben-Natan explained the mechanics of the exploit from a security perspective.
"The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have," Ben-Natan said, clarifying that without the specific upgrade, malicious actors would have been forced to orchestrate multiple, complex transactions to achieve the same financial extraction.
EIP-7702 Faced Security Concerns Before Binance Hack
Ethereum originally introduced Ethereum Improvement Proposal 7702 (EIP-7702) in May 2025 as a core component of its highly anticipated Pectra upgrade. The overarching goal of the proposal was to enhance user experience by allowing ordinary externally owned accounts, or standard wallets, to temporarily utilize smart-contract features. These features included highly functional capabilities such as transaction batching, where multiple actions can be executed simultaneously, and sponsored gas fees, which allow third parties to pay transaction costs on behalf of users.
Despite its innovative utility for standard users, security concerns surrounding EIP-7702 emerged almost immediately after its deployment. In May 2025, prominent crypto trading firm Wintermute published security findings indicating that a significant majority of early EIP-7702 delegations were pointing directly toward malicious smart contracts. These contracts were intentionally structured to automatically drain the assets of any compromised wallets that interacted with them.
These inherent risks resurfaced later in the year, specifically in September 2025, when holders of World Liberty Financial (WLFI) tokens reported substantial financial losses tied directly to malicious EIP-7702 delegations, highlighting a persistent vulnerability in how everyday users and even institutional platforms manage account abstractions and state delegations.
During discussions leading up to and following the implementation of EIP-7702, members of the broader Ethereum community repeatedly raised red flags. Ethereum community member VEER publicly referenced security warnings that had been thoroughly debated during the protocol’s development phases in 2024. Following the news of the Binance exploit, VEER observed that the scale of the attack appeared vastly broader than a single malicious signature, but emphasized that EIP-7702 effectively provided malicious actors with a convenient shortcut, describing it as "a handy sweep button on Ethereum."
Signing-System Compromise Suspected
As the post-mortem analysis of the multi-billion-dollar breach continued, Binance CEO Richard Teng stated publicly that investigators had found no concrete evidence to suggest that core wallet private keys had been directly leaked or exposed. Instead, security experts began focusing heavily on the intricate layers of infrastructure that govern how transactions are authorized within the massive exchange.
Blockaid’s Ben-Natan elaborated on this hypothesis, suggesting that the attackers successfully leveraged a compromised developer’s computer to infiltrate Binance’s internal wallet-signing infrastructure. This sophisticated pivot allowed the malicious actors to maneuver through the corporate network until they reached a position of high privilege.
"Eventually they got to a position where they could propose transactions to what is most likely a very secure signer that has custody of one of Binance’s hot wallets," Ben-Natan explained, detailing the anatomy of the intrusion. "The takeaway is that ultimately the signer signed a transaction that they shouldn’t have."
The vulnerability of complex signing systems remains a critical challenge for centralized platforms holding vast amounts of digital assets. While hot wallets are protected by multiple layers of institutional-grade security modules, a successful breach at the developer or signing-system level can bridge the gap between internal network access and ultimate cryptographic authorization.
Contrasting Perspectives on the Role of EIP-7702
While Blockaid emphasized the role of EIP-7702 in simplifying the extraction process for the hackers, other industry leaders offered nuanced views on how much weight the upgrade actually carried in the context of such a massive centralized exchange breach.
Ivo Georgiev, the co-founder and CEO of Ethereum wallet provider Ambire, argued that EIP-7702 made very little fundamental difference to the outcome of the attack, primarily because the hackers had already gained the necessary privileges to authorize transactions through compromised internal systems. According to Georgiev, the attackers possessed the capability to drain the funds through various traditional methods regardless of whether EIP-7702 was utilized.
However, Georgiev issued a stern warning regarding the after-effects of such an exploit, noting that exchange engineers and security teams might easily overlook the critical necessity of revoking a malicious EIP-7702 delegation after successfully regaining control of their compromised systems.
"This is a problem with EIP 7702, it’s just very very poorly understood," Georgiev remarked, pointing to the cognitive load and complexity that new Ethereum standard implementations place on security teams during high-stress incident responses.
Looking ahead, Ben-Natan warned that similar signing-system attacks pose an ongoing, severe threat to other centralized exchanges and digital asset platforms across the global cryptocurrency ecosystem. He emphasized that the widespread adoption of advanced transaction simulation tools could serve as a vital defensive layer, helping security infrastructure detect and block anomalous or malicious requests before they receive final approval from institutional signers.
Comments (0)