Compromised signing methods probably enabled Binance’s $6.3 billion hack, whereas Ethereum’s EIP-7702 improve could have helped attackers bypass safety checks, in accordance with blockchain safety agency Blockaid.
Attackers may have stolen the funds with out EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, instructed Cointelegraph on Friday.
“The 7702 improve is a means to do that in a single sweep and perhaps a strategy to bypass some type of checks they might have,” Ben-Natan mentioned, explaining that attackers in any other case would have wanted a number of transactions.
Binance confirmed Friday that it had suffered a $6.3 billion hack, the most important in crypto historical past, and pledged to cowl all losses. The alternate mentioned it uncovered further factors of breach after initially suspecting a compromised laptop computer belonging to one in every of its engineers.
EIP-7702 confronted safety issues earlier than Binance hack
Ethereum launched Ethereum Enchancment Proposal 7702 (EIP-7702) in Might 2025 as a part of its Pectra improve, permitting strange wallets to make use of smart-contract options corresponding to bundled transactions and sponsored gasoline charges.
Safety issues emerged inside weeks. In Might 2025, crypto buying and selling agency Wintermute reported that the majority early EIP-7702 delegations pointed to malicious contracts designed to routinely drain compromised wallets.
The dangers resurfaced in September 2025, when holders of World Liberty Monetary (WLFI) tokens reported losses linked to malicious EIP-7702 delegations.
Ethereum neighborhood member VEER cited safety warnings raised throughout discussions of EIP-7702 in 2024.
VEER later mentioned the Binance assault appeared broader than a single malicious signature, however that EIP-7702 gave attackers “a useful sweep button on Ethereum.”
Signing-system compromise suspected
Binance CEO Richard Teng mentioned investigators had discovered no proof that pockets non-public keys had leaked.
Ben-Natan mentioned attackers could have used a compromised developer’s laptop to achieve entry to Binance’s wallet-signing infrastructure.
“Ultimately they received to a place the place they may suggest transactions to what’s more than likely a really safe signer that has custody of one in every of Binance’s sizzling wallets,” he mentioned. “The takeaway is that finally the signer signed a transaction that they shouldn’t have,” he mentioned.
Dwell updates: Binance uncovers extra breach factors in $6.3B hack
Ivo Georgiev, co-founder and CEO of Ethereum pockets supplier Ambire, mentioned that EIP-7702 made little distinction to the assault as a result of the hackers already had the power to authorize transactions.
He mentioned attackers may have drained the funds by way of different strategies, however warned that alternate engineers may overlook the necessity to revoke a malicious EIP-7702 delegation after regaining management of their methods.
“This can be a drawback with EIP 7702, it’s simply very very poorly understood,” Georgiev mentioned.
Ben-Natan warned that comparable signing-system assaults threaten different exchanges and mentioned transaction simulation may assist detect malicious requests earlier than they obtain approval.
Journal: THORChain beneath fireplace over Bitget, ETH evolves past blockchain: Hodler’s Digest