• The Binance hack was not a simple case of someone guessing a password or leaking a private key. It was a coordinated attack on the systems that decide which transactions Binance’s wallets are allowed to sign.

This post gets into detail which tools were used, how the system was tricked into becoming a sweeper wallet and how its still going unnoticed in the eyes of the investigators. 

Strap in and get your nerd glasses on, because this one is high on techincal terms. Lets dive in!

THE ENTRY POINT

• As mentioned in my previous post, the attack was possible due to a compromised DevOps engineer's laptop. A DevOps engineer typically has access to infrastructure systems - servers, deployment tools, containers, and internal services that keep an exchange running.

• Once inside that laptop, the attacker allegedly gained access to a service container. In simple terms, a container is an isolated software environment running on Binance’s servers. It can perform specific internal tasks, such as processing withdrawal requests.

• That matters because the compromised container was reportedly allowed to submit withdrawal transactions to Binance’s signing infrastructure. In other words, the attacker did not need direct access to every wallet. They needed access to a trusted internal service that could request valid transaction signatures. Binance said it found no evidence that wallet private keys were ever leaked. 

THE SIPHONING OF HOT WALLETS

• Exchanges use two broad types of wallets:

- Cold wallets: offline storage used for the majority of customer funds.

- Hot wallets: internet-connected wallets used for day-to-day withdrawals and liquidity operations.

• Binance CEO Richard Teng said most user assets are held in cold wallets, while hot wallets hold funds needed for withdrawals. The hack targeted Binance’s hot wallets—the online wallets that continuously sign transactions.

• That is why the impact was so large. Hot wallets do not just sit idle. They process withdrawals, move funds between internal addresses, and interact with different blockchains. If an attacker can make those wallets sign malicious transactions, they can drain working balances quickly.

THE ETHEREUM EXPLOIT: EIP-7702

• The most technically interesting part happened on Ethereum. The attacker used EIP-7702, a feature introduced through Ethereum’s Pectra upgrade. EIP-7702 allows an ordinary externally owned account, or EOA, to delegate its behavior to a smart contract. Once the delegation is active, calls to that wallet can execute the contract’s logic with access to the wallet’s balances.

In plain English: a normal wallet can be made to follow the rules of a smart contract chosen by whoever controls the delegation.

• The attacker deployed a malicious “sweeper” contract. Its job was simple - when triggered, it could transfer listed tokens and ETH from the delegated wallet to an attacker-controlled address. The key detail is that the attacker needed Binance’s hot wallet to sign an EIP-7702 authorization. That authorization would delegate the wallet to the malicious contract.

BEATING ETHEREUM'S NONCE

• Ethereum accounts use a nonce - a transaction counter that increases with every transaction sent from that address. A signature is valid only for the correct nonce.

• This creates a problem for an attacker. If Binance’s wallet is actively processing withdrawals, its nonce keeps changing. A single pre-signed authorization might become invalid before it can be used.

• The attackers solved this by preparing 50 EIP-7702 authorizations in advance, covering a range of nonces from 18,914,775 to 18,914,824. Each authorization delegated the wallet to the attacker’s sweeper contract. Because Binance 14 was still processing legitimate withdrawals, the attacker could not know exactly which nonce would be active when the attack was executed. So they signed a batch. Forty-nine authorizations were invalid, but one matched the wallet’s current nonce.

That one valid signature was enough.

TURNING WALLET INTO SWEEPER

• At 20:20:59 UTC on October 29, the attacker sent a type-4 transaction carrying the EIP-7702 authorizations to Binance 14, one of Binance’s largest and most active Ethereum hot wallets.

• At 20:24:23 UTC - just over three minutes later - the attacker called the sweep function. The malicious contract moved approximately 167,464 ETH, 1.615 billion USDT, and around 60 other tokens from Binance 14 to a collection address with no prior history. That single Ethereum drain was worth about $2.5 billion.

◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇◇

Thats it for now! More news and updates will follow as soon as they get public. Next part will get into detail how the hacker group managed to cover their tracks, what other wallets were part of this and how investigators are having a hard time finding the original perpatrator.

Thank you for your time reading this far! Very much appreciated!

All the sources of this blog have been posted below for further readings

PsyberNews Signing off...