Blockaid: Binance Hot Wallet Allegedly Hit by EIP-7702 Authorization Attack

TechFlow reported on October 30 that, according to analysis by Web3 security firm Blockaid, in the suspected Binance theft incident, attackers submitted 50 EIP-7702 authorizations in a single transaction because they could not determine the real-time nonce of the hot wallet Binance 14, and only 1 took effect. Because the hot wallet was still continuously sending transactions at the time, one of the nonces happened to match. Blockaid previously said the address was subsequently upgraded to an unverified aggregation contract, and only the designated operator address could transfer out all tokens and ETH from it.

Whale Alert monitoring also showed that at 05:50 Beijing Time, the address labeled "Binance Hack 2026" transferred about 7.77 trillion PEPE to an unknown wallet, worth about $37.48 million. The above information has not yet been officially confirmed by Binance.

Source: TechFlow