Key Highlights:
- An attacker exploited Ethereum standard EIP-7702 to siphon approximately 204,500 ETH alongside altcoin assets from Binance-associated exchange wallets.
- The drain reduced Binance’s ETH reserve ratio from 100% to around 94%, though co-CEO Yi He and founder Changpeng Zhao affirmed that user funds remain secure and will be fully honored.
- Major stablecoin issuers and networks intervened swiftly, freezing billions in assets, including over $1.567 billion in USDT and hundreds of millions in USDC, Ripple-associated tokens, and USD1.
Binance Wallets Breached via Ethereum EIP-7702 Exploitation
A sophisticated threat actor has executed a massive exploit targeting wallets linked to crypto exchange Binance, leveraging an Ethereum standard known as EIP-7702. The mechanism permits an account to delegate transactional authority directly to external smart contract logic. By acquiring the cryptographic key to the Binance 14 wallet to authorize this delegation, the attacker converted the repository into an automated sweeper designed to reroute all incoming deposits to an address under their direct control.
On-chain records on Etherscan reveal the rapid succession of transfers during the breach. At 20:24 UTC (4:24 pm ET), the attacker orchestrated the movement of 167,464 ETH out of the Binance 14 wallet. Moments later, an additional 28,005.6 ETH was siphoned from Binance 16, consolidating both outflows into the attacker’s primary repository. Approximately 15 minutes after the initial withdrawals, 195,460 ETH—valued at roughly $442 million—was transferred to a secondary staging address.
Reserve Deficits and Multitoken Impact
The total theft of roughly 204,500 ETH directly impacts Binance’s financial cushion. As of October 1, the exchange reported holding a 100% reserve ratio for customer Ethereum balances, alongside 108.26% backing for user USDC. Because the extracted ether represents approximately 5.6% of Binance’s total ETH reserves, the immediate loss effectively dropped the platform’s ETH collateralization level to near 94%.
Beyond Ethereum, the perpetrator drained smaller holdings of several prominent altcoins. The exploit swept quantities of Ethena (ENA), Uniswap (UNI), Pepe (PEPE), and Aave (AAVE), with stolen amounts representing anywhere from 7% to 15% of Binance’s reported reserves for each respective token.
Executive Reassurance and Coordinated Industry Freezes
Despite the reserve shortfall, Binance leadership has acted to reassure the market. Binance and its co-CEO Yi He have confirmed that user balances remain safe and will be honored despite the underlying deficit created by the theft. Similarly, Binance founder Changpeng Zhao stated that he expects users to be fully recovered from the incident.
Simultaneously, major centralized issuers initiated emergency countermeasures to limit the attacker’s ability to liquidate proceeds. Tether CEO Paolo Ardoino confirmed that more than 1.567 billion USDT had been blacklisted and frozen. Changpeng Zhao detailed that Circle placed a freeze on roughly $823 million in USDC. Additional countermeasures saw Ripple freeze around $200 million in digital assets, while decentralized protocol World Liberty Financial successfully froze $27 million worth of its USD1 stablecoin.
Why This Matters
The breach marks one of the most high-profile exploitations involving EIP-7702, illustrating how smart contract account abstractions and signature delegation can be weaponized against institutional-grade exchange wallets if private keys are compromised. While the event stresses Binance’s spot balance sheet below full ETH reserve coverage, the rapid response from centralized stablecoin issuers highlights the critical, coordinated circuit breakers that issuers can enforce to mitigate systemic cross-industry contagion.
Frequently Asked Questions
How did the attacker gain control of the Binance wallet?
The attacker leveraged EIP-7702, an Ethereum feature that allows an existing account to delegate control to a software contract. After obtaining the private key for the Binance 14 address to sign the permission, the attacker set up automated sweeper logic that diverted inbound assets to attacker-controlled wallets.
Are Binance customer accounts and funds safe?
Yes. Binance and co-CEO Yi He stated that customer assets are secure, meaning user account balances will be respected and honored even though the underlying reserve assets dropped to around 94% coverage. Changpeng Zhao also reaffirmed expectations of a full recovery for affected balances.
How much stolen currency was frozen by stablecoin issuers?
Multiple issuers moved quickly to halt transactions. Over $1.567 billion in USDT was frozen by Tether, approximately $823 million in USDC was frozen by Circle, Ripple froze around $200 million in assets, and World Liberty Financial immobilized $27 million of USD1.
