Binance’s $6.3 billion crypto theft appears to have begun with a compromise of the exchange’s transaction-signing systems, while an Ethereum upgrade may have made it easier for attackers to move funds in a single operation. Security experts cited by Cointelegraph said the hackers could probably have drained the wallets without the upgrade, although EIP-7702 may have helped them get around some withdrawal safeguards.
How the attack unfolded
Binance confirmed on Friday that it had been hacked and said it would cover all losses. The exchange initially suspected that an engineer’s laptop had been compromised, but later identified additional points of breach as its investigation continued.
The incident involved wallets holding approximately $6.3 billion, making it the largest hack in crypto history, according to the source material. Binance CEO Richard Teng said investigators had found no evidence that the exchange’s wallet private keys had been leaked.
Instead, the suspected weakness appears to have involved the systems used to approve transactions. Ido Ben-Natan, co-founder and chief executive of blockchain security firm Blockaid, said an attacker may have gained access through a compromised developer’s computer and reached Binance’s wallet-signing infrastructure.
In that scenario, the attacker would not necessarily need to steal private keys directly. The critical failure would be getting an unauthorized transaction in front of a secure signer and having it approved. Ben-Natan said the signer ultimately authorized a transaction that should not have been accepted.
What EIP-7702 changed
Ethereum introduced EIP-7702 in May 2025 as part of its Pectra upgrade. The proposal allows ordinary, externally owned wallets to temporarily use smart-contract functionality. Among other capabilities, this can support bundled transactions and transactions in which gas fees are sponsored by another party.
Those features can make wallet operations more flexible, but they also introduce additional security considerations. Ben-Natan said EIP-7702 was not the root cause of the Binance breach. Rather, it may have given the attackers a way to execute the theft in one broad operation and potentially bypass some of the exchange’s checks. Without the upgrade, he said, the attackers might have needed to submit multiple transactions.
Ivo Georgiev, co-founder and chief executive of Ethereum wallet provider Ambire, took a different view of the upgrade’s practical importance. He said EIP-7702 made little difference because the attackers already appeared to have the ability to authorize transactions. In his assessment, the funds could have been drained through other methods.
Georgiev nevertheless identified a separate risk: after recovering control of compromised systems, exchange engineers could fail to revoke a malicious EIP-7702 delegation. A delegation can give a wallet instructions to use specified smart-contract functionality, so leaving a harmful one active could create a further security problem. Georgiev said the feature remains poorly understood.
Earlier warnings about the feature
Concerns around EIP-7702 emerged soon after its introduction. In May 2025, crypto trading firm Wintermute reported that most early delegations using the proposal pointed to malicious contracts designed to drain compromised wallets automatically.
The issue resurfaced in September 2025, when holders of World Liberty Financial tokens reported losses associated with malicious EIP-7702 delegations. Ethereum community member VEER also pointed to security warnings raised during discussions of the proposal in 2024.
VEER later said the Binance incident appeared to involve more than one malicious signature, while describing EIP-7702 as a convenient way to sweep funds on Ethereum. The comments underline the distinction between an attack’s initial entry point and the tools that may make the final transfer faster or broader.
Blockaid’s Ben-Natan warned that attacks on transaction-signing systems could affect other crypto exchanges as well. He said transaction simulation could help identify harmful requests before they are approved. Simulation generally allows a proposed blockchain transaction to be examined for its likely effects without immediately committing it to the network.
Current market picture
Moneyiar market data at 2026-10-25 22:39 +03:30 showed Ethereum at $2,342.0570017305, up 0.02% over 24 hours but down 1.77% over seven days. BNB stood at $740.8618136891, with a 24-hour gain of 0.81% and a seven-day increase of 3.32%.
- Shiba Inu: $0.0000048638, down 0.75% in 24 hours and 1.21% over seven days.
- Uniswap: $6.9787690874, up 2.51% in 24 hours and down 2.12% over seven days.
The Binance breach places attention on the security of exchange approval processes as well as on the safety of individual wallet software. The expert assessments available so far do not identify EIP-7702 as the cause of the theft, but they suggest that new wallet features can affect how quickly attackers exploit a compromise and how effectively existing safeguards respond.
