WirecompaniesDextape brief
How the Binance hack happened on-chain on Ethereum
The hack of Binance's Ethereum on-chain relied on EIP-7702 to target at least one address and regular transfers for other addresses.
Dextape brief
The Binance hack, described as one of the largest heists ever, exploited how wallet delegation works on Ethereum. Per Protos, the attacker seemingly deployed a sweeper contract and sent 50 EIP-7702 authorizations aimed at the Binance 14 address, all signed with its key. Since Binance 14 was a busy hot wallet, the attacker varied nonce values across the approvals so each matched the wallet's current count. Once approved, the sweeper ran as though it were the Binance 14 account and drained its ether and tokens. The article notes Binance 16 moved funds through regular transactions, as did several other EVM networks. Binance later removed the delegation from Binance 14, and roughly $2.4 billion pulled from its Ethereum wallets has been frozen or blacklisted.
Why it matters: It shows that a delegation mechanism on Ethereum can be turned against an exchange's hot wallet, a concern for anyone holding assets on exchanges.
Read the full story
Dextape context
Built from Dextape’s own wire, stories and glossary.
Dextape story on this event
Binance hot wallet theft estimated at $6.3 billion, analysts link it to North Korea
Terms in this story
- Address
- A public identifier that can receive assets on a particular network.
Mentioned in this story
Open a coin page for its current price.