Binance Hot Wallets: EIP-7702 Delegation Swept Binance-Labeled Wallets on Ethereum

~$6.3B estimated total impact and ~$3B frozen, per Binance (claimed; all chains). On-chain, Ethereum only: 200,630.004561620147322012 ETH plus tokens left Binance-labeled wallets, ≈$3.79B at 20:24 UTC prices.

Root cause: Claimed (Binance): initial investigation suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions; Binance has found "no evidence of any wallet private key leak". Confirmed (on-chain): the wallet Etherscan labels "Binance 14" was EIP-7702-delegated to an operator-only sweeper contract by an authorization that recovers to its own key. Unknown: how that authorization was produced. Post-mortem pending.

Timeline, as sourced: Operator funded via Tornado Cash 28–29 Oct; delegation 29 Oct 2026 20:20:59 UTC; first sweep 20:24:23 UTC; Tether freeze 21:01:35 UTC, Circle 21:04:59 UTC (on-chain). Binance update 30 Oct 02:25 UTC. Traced as of block 26302791 (30 Oct 03:10 UTC).

Ethereum, 29 Oct 2026, from 20:20 UTC. Binance reported a security incident affecting its hot wallets (announcement (opens in a new tab)). This entry covers the Ethereum side only, traced on-chain by NullMeridian as of block 26302791 (30 Oct 03:10 UTC); thread: NullMeridian on X (opens in a new tab). All times UTC. Address labels are Etherscan public name tags, which are third-party labels.

Claimed (Binance) (announcement (opens in a new tab), X (opens in a new tab)): "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Binance says it has found "no evidence of any wallet private key leak", estimates total impact at around $6.3B with ~$3B frozen on-chain, says it will cover all losses from the SAFU fund and company funds, and will publish a technical post-mortem.

Confirmed (on-chain): the operator, the wallet Etherscan labels "Binance Hot Wallet Exploiter", 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 (opens in a new tab), received three Tornado Cash 0.1 ETH pool withdrawals on 28–29 Oct (first tx (opens in a new tab)). On 29 Oct it delegated two small test wallets at 13:51 UTC and at 15:59:11 UTC deployed the sweeper contract 0x63e842B054Bd624a465454D533C33F573e9c6fAe (opens in a new tab), whose bytecode hard-codes the operator as the only caller (deploy tx (opens in a new tab)).

Confirmed (on-chain): at 20:20:59 UTC the operator sent one type-4 (EIP-7702) transaction carrying 50 authorizations (tx (opens in a new tab)). All 50 recover (ecrecover) to the key of the wallet Etherscan labels "Binance 14", 0x28C6c06298d514Db089934071355E5743bf21d60 (opens in a new tab), for consecutive nonces 18,914,775 to 18,914,824. Exactly one, nonce 18,914,809, matched, and Binance 14's code became a delegation to the sweeper.

Confirmed (on-chain): at 20:24:23 UTC one sweep moved 167,464.247856558836135296 ETH and 63 tokens, including 1,615,409,498.97324 USDT, from Binance 14 to the address Etherscan labels "Binance Hot Wallet Exploiter 2", 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c (opens in a new tab) (tx (opens in a new tab)). At 20:24:47 UTC the wallet Etherscan labels "Binance 16", 0xDFd5293D8e347dFe59E90eFd55b2956a1343963d (opens in a new tab), sent 28,005.6 ETH and 8 tokens to the same address in ordinary transactions signed by its own key; it was not delegated (tx (opens in a new tab)). At 20:41:23 and 20:59:47 UTC, through the delegated Binance 14, 780,000,000 and 43,000,000 USDC moved from the wallet Etherscan labels "Binance: Hot Wallet 34", 0xEe7aE85f2Fe2239E27D9c1E23fFFe168D63b4055 (opens in a new tab), to Exploiter 2 (tx 1 (opens in a new tab), tx 2 (opens in a new tab)).

Confirmed (on-chain): in total 200,630.004561620147322012 ETH plus tokens left Binance-labeled wallets on Ethereum, ≈$3.79B at 20:24 UTC prices (DefiLlama; ETH $2,313.26; one token, IDRT, unpriced). Binance's ~$6.3B estimate also covers other chains; Bitcoin and Tron were not traced here.

Confirmed (on-chain): Tether blacklisted Exploiter 2 at 21:01:35 UTC while it held 971,149,299.483240 USDT (tx (opens in a new tab)); two later sweeps added 204,315,411.59 USDT to the frozen address (tx 1 (opens in a new tab), tx 2 (opens in a new tab)). Circle blacklisted the same address, holding 823,000,000 USDC, at 21:04:59 UTC (tx (opens in a new tab)). Tether also blacklisted the address Etherscan labels "Exploiter 21", 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0 (opens in a new tab), holding 174,999,872.32752 USDT, at 21:14:59 UTC (tx (opens in a new tab)), and the address Etherscan labels "Exploiter 7", 0xb171cA86f82070282138352Ff7111b494060c8c3 (opens in a new tab), holding 30,000,000 USDT, at 21:18:59 UTC (tx (opens in a new tab)).

Confirmed (on-chain): 700,000,000 USDT left Exploiter 2 at 20:30 to 20:33 UTC, before the freeze: 500,000,000 USDT to 0x9749292D74Fd460982d0912eA9515EA24736C762 (opens in a new tab) (tx (opens in a new tab)) and 200,000,000 USDT to 0x0Ddf0480016e6bCb2C1F5d190D221FBA1320697e (opens in a new tab) (tx (opens in a new tab)). Of the 700M, 435M was swapped to ETH, 60M was supplied to Aave v3 with 19,762.70 WETH borrowed against it (tx (opens in a new tab)), and 205M was frozen downstream (the two Tether freezes above).

Confirmed (on-chain): the three largest ETH holdings had no outgoing transaction as of block 26302791: the address Etherscan labels "Exploiter 8", 0x8532FA14ACAf483729C449b8458aedDb900543D4 (opens in a new tab), 197,460 ETH; "Exploiter 19", 0xc887aF690E0301CD4edBbCe8F8d31b4EC65B286A (opens in a new tab), 137,602 ETH; "Exploiter 11", 0x897C80d1a9729E94460e2Bd93178bD5215158DF3 (opens in a new tab), 78,415 ETH. No mixer, bridge or exchange deposit was seen in the hops traced.

Confirmed (on-chain): at 20:32:11 UTC a third party emitted a 0-value USDT transfer from Exploiter 2 to 0x9749110a86941480DbeFcA1EfDC0ceb528a0c762 (opens in a new tab), a lookalike of the real 500M USDT recipient 0x9749292D74Fd460982d0912eA9515EA24736C762 (opens in a new tab) (tx (opens in a new tab)). The two addresses share their first and last four characters.

Claimed: Tether CEO Paolo Ardoino says Tether froze "more than 1.567B USDT" (post (opens in a new tab)); Circle CEO Jeremy Allaire says Circle froze "more than 800M USDC" (post (opens in a new tab)). Binance paused withdrawals until "the security issue is fully resolved" (post (opens in a new tab)).

Confirmed (on-chain): at 00:10:35 UTC on 30 Oct, Binance 14 sent a type-4 transaction with an authorization to the zero address, clearing the delegation (tx (opens in a new tab)).

Unknown: how the authorizations and Binance 16's transfers were produced through Binance's signing path (on-chain, the signatures are valid for those wallets' keys; whether any key left the signing system is not known); Bitcoin and Tron outflows; how Binance's ~$3B frozen figure breaks down by chain; attribution. Binance's post-mortem is pending (announcement (opens in a new tab)).

Update, 29 Oct 2026. Confirmed (on-chain): MetaMask infrastructure appears on downstream attacker wallets. Times ET (UTC−4). The wallet Etherscan labels "Exploiter 21", 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0 (opens in a new tab), received 0.033667835195600075 ETH from "MetaMask: Gas Station 3" at 5:12:59 PM (https://etherscan.io/tx/0x9a3a5d8ce9ae4d5865f21f92b741cc51fa75ac19cd9bb79d23fa2224ba38ccc3 (opens in a new tab)), then paid 127.67248 USDT to "MetaMask: Gas Station Swap" in the same block (https://etherscan.io/tx/0x11be88b460501b4652e760c41e08cc1f18575e14b6c6ffbb3383e043c2decf34 (opens in a new tab)). Two attacker wallets were upgraded to "MetaMask: EIP-7702 Delegator", 0x63c0c19a282a1B52b07dD5a65b58948A07DAE32B (opens in a new tab): "Exploiter 4", 0x77EDEf23FBd05921c26FE29fcc3A65e14D2ac3eb (opens in a new tab), at 5:04:47 PM (https://etherscan.io/tx/0xb7d294873bf18a56ce99115794b8a9a76542791b58456e7a4f94d74f1ae4e41f (opens in a new tab)), and "Exploiter 5", 0x7Aa4D3029e4C6A8E916300014Ad95B6d6C03BFd1 (opens in a new tab), at 5:08:23 PM (https://etherscan.io/tx/0x808f54a951b7fd051600937b45c6c3fb42d59850c6bf459cea8615dfadbcad39 (opens in a new tab)). "Exploiter 9", 0x3E2bf1ac6bf0934BBba6456C341c2EcbCED632d5 (opens in a new tab), bridged 0.486312703070044525 ETH to Arbitrum via "MetaMask: Meta Bridge" at 5:31:11 PM (https://etherscan.io/tx/0xc5892899fa23a64ab99339b8a3bd9e1ef00c81319b33bbd77467f4b55df1ec2c (opens in a new tab)). The operator, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 (opens in a new tab), shows no MetaMask use. First public flag: https://x.com/justinkalland/status/2115946980665151955 (opens in a new tab). Claimed (MetaMask), 29 Oct 2026, 9:21 PM ET, its only public statement: "Our security team is aware of this report and are investigating" (https://x.com/MetaMask/status/2115977377989955778 (opens in a new tab)).

Update, 30 Oct 2026. Confirmed (on-chain): at 1:15:47 AM ET, "Binance Hot Wallet Exploiter 2", 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c (opens in a new tab), sent 17,260 ETH to the unlabeled wallet 0x03b0eE5d82990cFF1bDa48651AC3e436d1a020ea (opens in a new tab) (https://etherscan.io/tx/0x9edf86533e73658700c5dadb2432dd7bebb628dc0f5fe37991c241f537856071 (opens in a new tab)), after a 0.1 ETH test at 1:14:35 AM ET (https://etherscan.io/tx/0x88e4bc31dc948ac5dedb3a9936d2e429494e0ae1ff3dfce70e673ac194b06b78 (opens in a new tab)). As of 6:37 PM ET on 30 Oct, that wallet had sent nothing. No Tornado Cash deposits were seen from it or from 43 Etherscan-labeled attacker wallets. Unconfirmed: OnchainLens says the hacker is "preparing to launder" (https://x.com/OnchainLens/status/2116040031315849646 (opens in a new tab)).