Key Highlights
- A compromised DevOps engineer’s laptop triggered unauthorized hot wallet withdrawals at Binance, leading to approximately $3 billion in frozen funds.
- Security firm Blockaid detected unusual outflows in under two minutes and traced the attack mechanism to malicious Ethereum EIP-7702 delegations.
- Blockaid CEO Ido Ben-Natan identified the incident as a hijacking of signing infrastructure rather than a direct theft of private keys, drawing parallels to the February 2025 Bybit breach.
Compromised DevOps Machine Triggers Unauthorized Binance Outflows
A recent security breach at cryptocurrency exchange Binance has been traced back to a compromised laptop belonging to a DevOps engineer. The breach on the engineer’s machine created an entry point that allowed attackers to execute unauthorized withdrawals directly from the platform’s hot wallets—the internet-connected systems utilized by exchanges to facilitate routine, day-to-day user withdrawals. While hot wallets are essential for maintaining liquidity and operational speed, their network connectivity makes them a prime vector for sophisticated cyberattacks.
According to blockchain security firm Blockaid, the anomalous outflows were spotted rapidly. Blockaid revealed that its artificial intelligence monitoring models flagged suspicious transactions leaving Binance’s hot wallets in less than two minutes from the onset. Within 11 minutes, the security team pinpointed malicious activity tied directly to Ethereum Improvement Proposal (EIP) 7702 delegations, exposing how the attackers manipulated transaction structures to divert exchange reserves.
EIP-7702 Exploitation: Hijacking Signers Over Stealing Keys
The technical mechanics of the attack involved an emerging Ethereum functionality rather than an outright theft of credentials. Under EIP-7702, standard wallets can temporarily delegate their behavior and operational control to smart contract code. Blockaid’s forensic breakdown determined that the exploiters relied on this exact delegation mechanism to siphon assets out of Binance’s accounts.
Blockaid CEO Ido Ben-Natan underscored that the exploit represents an attack on operational systems rather than standard key leakage. Ben-Natan framed the breach as a misuse of signing infrastructure rather than a simple theft of private keys. Furthermore, Ben-Natan drew a direct parallel between the Binance event and the February 2025 breach suffered by Bybit, highlighting an alarming industry trend where malicious actors target the signing machinery, workflows, and permissions that wrap around private keys rather than attempting to compromise the keys themselves.
Venture Interest Accelerates for Security Infrastructure
The incident coincides with increased investor attention on cybersecurity platforms capable of mitigating automated, smart-contract-level vulnerabilities. Blockaid, which previously established relationships with prominent venture firms including Sequoia Capital and GV, has recently secured new funding commitments. While these commitments demonstrate strong investor intent to finance real-time security solutions, the formal terms and final roster of round participants have not yet been publicly disclosed in detail.
Why This Matters
This incident delivers a critical warning to centralized exchanges and digital asset custodians: traditional cold storage and rigid key-signing ceremonies are insufficient if administrative and operational endpoints remain vulnerable. The breach demonstrates that an endpoint security failure on a single DevOps engineer’s computer can compromise the surrounding approval flows and trigger significant systemic disruption. For crypto market participants, Binance’s prompt action to freeze approximately $3 billion stands as the most vital immediate outcome, preventing broader systemic contagion.
Moving forward, several key developments will shape the fallout from this attack. Industry observers are monitoring how much of the $3 billion in frozen assets will be fully restored and returned to rightful owners. Additionally, the exploit is likely to prompt competing centralized exchanges to audit their signing infrastructure and assess their vulnerability to EIP-7702 contract delegations. Finally, market focus remains on whether security startups like Blockaid successfully finalize their current funding rounds and whether rival cybersecurity firms will announce similar capital injections to counter infrastructure-level exploits.
Frequently Asked Questions
How did attackers breach Binance’s hot wallets?
Attackers gained access via a compromised laptop belonging to a Binance DevOps engineer. This granted the unauthorized access needed to manipulate withdrawal pipelines without needing to directly steal the underlying private keys.
What role did EIP-7702 play in the exploit?
EIP-7702 allows standard Ethereum wallets to delegate their functions to smart contract code. The attackers leveraged these delegations to redirect transaction authorizations and pull funds directly from the exchange’s hot wallet infrastructure.
How much capital was affected by the security incident?
In response to the unauthorized withdrawals, Binance acted to freeze approximately $3 billion in assets while investigating the scope of the exploit and working on fund recovery.
