Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Open

EIP-7702 caused the hack

After Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation, some commenters treated the Ethereum feature as the cause. Ethereum community member VEER said it gave attackers a handy sweep button on Ethereum.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

Binance co-CEO Richard Teng is reported as saying the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet. Blockaid says the attacker first drained a Binance wallet in a single transaction of about $2.5B from 20:24 UTC, minutes after Binance's signing infrastructure, which it says was under the attacker's control, signed an EIP-7702 authorization delegating that wallet to an attacker-deployed sweeper; Hacken puts one Ethereum transaction at about $2.53B. TRM Labs says Binance wallets on the other nine chains sent funds through ordinary signed transfers. Blockaid's CEO told Cointelegraph attackers could have stolen the funds without EIP-7702, and the CEO of the wallet provider Ambire said it made little difference. Hacken, quoting investigators, and Blockaid's CEO point to a compromise of Binance's signing system. The record shows the feature was used on Ethereum; it does not settle whether it was the cause. In the sources captured as of 2026-11-01, Binance has not published a root cause.

Evidence

Evidence for (3)

Reported

Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Richard Teng, Cointelegraph. Captured . Original

Note: Teng: the delegation did not pass through normal approval controls.

Reported

Cointelegraph quoted the speaker as saying the 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have.

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”

Ido Ben-Natan, Cointelegraph. Captured . Original

Note: Blockaid's CEO: 7702 is a way to do it in one sweep.

Reported

Cointelegraph reported that Ethereum community member VEER said EIP-7702 gave attackers a handy sweep button on Ethereum.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

Cointelegraph. Captured . Original

Note: A handy sweep button on Ethereum.

Evidence against (4)

Reported

Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Hacken. Captured . Original

Note: Signing system signed across chains.

Reported

TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

TRM Labs, TRM Labs. Captured . Original

Note: Other chains used ordinary signed transfers.

Reported

Cointelegraph reported that Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702.

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

Ido Ben-Natan, Cointelegraph. Captured . Original

Note: Attackers could have stolen the funds without EIP-7702.

Reported

Cointelegraph reported that Ambire CEO Ivo Georgiev said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

Ivo Georgiev, Cointelegraph. Captured . Original

Note: EIP-7702 made little difference.

Context (3)

Reported

Hacken said that at Binance the delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.

At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again

Hacken. Captured . Original

Note: The delegation stayed in place for 3 hours 46 minutes.

Reported

Blockaid said the delegation was visible on-chain for three minutes and 24 seconds before the sweep.

The delegation itself was visible onchain for three minutes and 24 seconds before the sweep

blockaid.io. Captured . Original

Note: Delegation visible before the sweep.

Reported

Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.

Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.

blockaid.io. Captured . Original

Note: Blockaid says its engine flagged the delegation.