By Binance is working with law-enforcement agencies including the FBI and U.S. Secret Service after hackers stole an estimated $6.3 billion across multiple blockchains, while the exchange investigates how attackers obtained valid authorization to move assets from its wallets without an apparent leak of private keys.
The theft, now the largest known cryptocurrency hack, extended across Ethereum, Bitcoin, XRP Ledger, Solana, Tron and other networks. Binance says about $3 billion of the affected assets have been frozen and has pledged to cover losses using its Secure Asset Fund for Users and company funds.
One of the clearest windows into the attack comes from Ethereum, where the attacker used EIP-7702 to make a Binance-controlled wallet execute malicious code. But the wider breach is more difficult to explain: transactions across several unrelated blockchains were also signed with valid authority from Binance wallets.
How Did EIP-7702 Turn Binance 14 Into a Sweeper?
Ethereum’s EIP-7702 allows a conventional externally owned account to temporarily execute smart-contract code. Introduced with the Pectra upgrade in May 2025, the feature enables functions such as transaction batching and sponsored gas payments without permanently converting a wallet into a smart contract.
In the Binance attack, that flexibility became part of the exploit path.
The attacker deployed a malicious sweeper contract and then submitted 50 EIP-7702 authorizations signed by the wallet Etherscan labels “Binance 14.” Each authorization covered a consecutive account nonce, giving the attacker a range of valid permissions while Binance continued processing transactions.
Ethereum accepted the authorization matching nonce 18,914,809. Minutes later, the attacker called the delegated code and moved roughly 167,464 ETH and dozens of tokens, including about 1.6 billion USDT, from Binance 14.
The wallet continued receiving customer deposits after the delegation was active, allowing the attacker to sweep additional funds later. The malicious authorization remained in place for nearly four hours before Binance revoked it.
FinanceFeeds’ initial on-chain review of the Binance hack identified the Tornado Cash-funded attacker, the EIP-7702 delegation and the sweeper contract before Binance disclosed the full $6.3 billion impact.
Investor Takeaway
EIP-7702 was the execution mechanism on Ethereum, but it does not explain how the attacker obtained valid Binance signatures. The more important security question is what system was authorized to produce those signatures and how the attacker reached it.
Why Did the Attacker Prepare 50 Valid Authorizations?
Binance 14 was processing frequent withdrawals, meaning its nonce changed constantly. A single authorization tied to one nonce could have become unusable before the attacker managed to submit it.
The attacker appears to have solved that problem by obtaining 50 signed authorizations covering consecutive nonce values. Only the authorization matching the wallet’s next available nonce became valid; the remaining 49 were ignored.
That preparation indicates the attacker had access to a mechanism capable of repeatedly obtaining valid Binance authorizations before executing the theft.
The Ethereum activity was not isolated. Blockchain security firm Blockaid identified multiple Binance-controlled keys involved in signed activity during the wider incident, while Binance Co-CEO Richard Teng has said investigators have found no evidence that wallet private keys themselves were leaked. FinanceFeeds examined the apparent tension between multiple valid signatures and Binance’s no-key-leak finding.
Those statements can both be true if an attacker compromised infrastructure capable of requesting legitimate signatures without actually extracting the underlying keys.
Does the DevOps Laptop Explain a Multi-Chain Theft?
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop. According to Teng, the compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
Binance has since said investigators discovered additional points of breach beyond the laptop and cautioned that the attack was not a simple case of one employee’s permissions being abused.
That distinction matters because EIP-7702 only exists on Ethereum. The attacker also moved 18,270 bitcoin, hundreds of millions of dollars in XRP and assets from several other networks through ordinary signed transactions.
TRM Labs argues that the cross-chain pattern points toward a compromise of Binance’s signing infrastructure rather than a vulnerability limited to one blockchain.
The analytics firm has attributed the theft with high confidence to North Korea’s TraderTraitor operation, while Chainalysis has reached a similar assessment. Binance has not publicly attributed the attack, and no U.S. government agency has formally identified the perpetrator. FinanceFeeds previously detailed the evidence linking the attack to the Lazarus-associated group.
Investor Takeaway
The multi-chain signatures make this a custody-infrastructure problem rather than simply an Ethereum smart-contract exploit. If Binance’s signing systems were induced to authorize withdrawals correctly, traditional distinctions between a stolen private key and an unauthorized transaction become less useful for evaluating operational risk.
How Much of the $6.3 Billion Can Binance Recover?
Binance says approximately $3 billion of the affected assets have been frozen through cooperation with stablecoin issuers, blockchain networks and security partners.
Tether, Circle and other issuers can blacklist centralized tokens such as USDT and USDC, but assets including bitcoin and ether cannot be frozen through an issuer in the same way. The attacker still controls large cryptocurrency balances that can be moved through swaps, bridges and other laundering routes.
Binance has pledged to cover all losses through SAFU and company funds. Its emergency fund was created after earlier exchange security incidents and held roughly $1 billion before the attack, meaning the corporate balance sheet may ultimately carry a substantial portion of any unrecovered loss.
Law-enforcement involvement now adds a second recovery channel. Binance is cooperating internationally, including with the FBI and Secret Service, as investigators trace wallets and try to identify infrastructure or counterparties that can still interrupt the movement of funds.
Investor Takeaway
Freezing $3 billion does not mean Binance has recovered $3 billion. The financial impact will depend on how much frozen property is ultimately returned, how much remains under attacker control and how much Binance must replace from SAFU and its own balance sheet.