Binance’s $6.3 Billion Hack Likely Enabled by Signing System Breach and Ethereum’s EIP-7702 Exploit

Binance confirmed on Friday that it was the target of the largest hack in crypto history, suffering losses of $6.3 billion. Following initial suspicions of a compromised engineer's laptop, the exchange discovered further breach points and pledged to compensate all affected users.

Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph that attackers might have succeeded even without the EIP-7702 update but explained that this upgrade made it possible to perform the theft in a single transaction and potentially evade certain protective verifications. Without it, the hackers would have needed multiple individual transactions.

Ethereum implemented the Ethereum Improvement Proposal 7702 (EIP-7702) in May 2025 as part of the Pectra upgrade. This allowed regular wallets to utilize advanced smart contract features, such as batch transactions and sponsored gas fees.

Shortly after its release, security concerns arose. In May 2025, crypto trading firm Wintermute revealed that the majority of early EIP-7702 delegations targeted malicious contracts designed to automatically drain compromised wallets. By September 2025, World Liberty Financial (WLFI) token holders reported losses linked to harmful EIP-7702 delegations.

An Ethereum community member named VEER recalled warnings about security risks discussed during the EIP-7702 debates in 2024. VEER noted that the Binance hack seemed to be more extensive than a single malicious signature, and that EIP-7702 provided attackers with a convenient method for mass transaction execution on Ethereum.

Binance CEO Richard Teng stated that investigations found no evidence that private wallet keys had been leaked during the attack. However, Ben-Natan suggested hackers might have gained access to Binance’s wallet-signing infrastructure via a compromised developer’s computer.

Ben-Natan elaborated that attackers were eventually able to propose transactions to a highly secured signer managing one of Binance's hot wallets. The critical point, he said, was that the signer ended up authorizing a transaction it should not have approved.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, commented that EIP-7702 likely had minimal impact on the attack since the hackers already had transaction authorization capabilities. Nevertheless, he warned that exchange engineers might overlook the importance of revoking malicious EIP-7702 delegations after regaining control.

Georgiev described the vulnerabilities related to EIP-7702 as being poorly understood. Ben-Natan also cautioned that similar signing system attacks could threaten other exchanges. He emphasized that simulating transactions before approval could help identify and block malicious requests.

This investigation highlights significant risks associated with signing system security and Ethereum’s EIP-7702 upgrade, underscoring the need for better understanding and improved safeguards in blockchain infrastructure. The Binance hack serves as a critical reminder that both technological upgrades and operational controls must evolve to defend against sophisticated cyberattacks.

The significance of this analysis lies in revealing how vulnerabilities in signing systems combined with protocol upgrades like EIP-7702 can drastically increase the scale and speed of crypto exchange hacks, pointing to a pressing need for enhanced security measures industry-wide.

why

This case underscores the vital importance of thoroughly vetting blockchain upgrades and securing signing infrastructures, as weaknesses in these areas can facilitate massive breaches with devastating consequences for the crypto ecosystem.

type

object

properties

title

string

introHeading