Binance hot wallet drainer packed 50 EIP-7702 authorizations into one tx to beat the nonce
Kyrannio · x · 2026-10-30
Blockaid's on-chain forensics reveals how the Binance hot wallet was drained: the attacker used 50 EIP-7702 authorizations signed with the wallet's own private key.
- An EIP-7702 authorization is a signed permission letting a wallet hand control to code, valid only for the wallet's next nonce — which kept changing as Binance kept sending transactions.
- Unable to predict which nonce would land, the sender packed all 50 authorizations into a single transaction; one matched.
- That match installed a sweeper contract operable only by the Tornado Cash-funded sender, which emptied the wallet minutes later.
More from Safety
- House Democrats push resolution against AI bailouts as industry debt nears TARP scale — aakashgupta · 2026-10-30
- DeepSeek's cyber model gates access with export-control and sanctions questionnaires, leaked frontend code shows — teortaxesTex · 2026-10-30
- Court filing argues OpenAI's training on copyrighted books produces substitutes for the originals — TuhinChakr · 2026-10-30
- MalwareTech: IoT malware is like spiders in your house, not worth clearing out — MalwareTechBlog · 2026-10-30
- Anthropic's Claude now self-assesses conversations to flag misuse others miss — elonmusk · 2026-10-30
- Binance hit by $6.3B heist via compromised DevOps laptop; DeepSeek found in separate firewall breach — ChrisGPT · 2026-10-30