Binance Loses $6.15 Billion in 31 Minutes as Hackers Exploit EIP‑7702 Authorization

On October 29, 2026, an attacker drained approximately $6.15 billion from Binance’s hot wallets across nine blockchains in just 31 minutes. The theft did not involve stolen private keys; instead, the attacker leveraged Binance’s own authorization system, specifically the EIP‑7702 feature that allows a smart contract to act on a wallet’s behalf. Prior to the attack, the attacker funded their wallets via Tornado Cash to obscure the source of funds and conducted two rehearsals on their own wallets to test a custom smart‑contract draining tool. The final version of the tool could execute arbitrary calls on delegated wallets, enabling the attacker to command a Binance smart wallet to release 823 million USDC. The incident highlights a critical vulnerability in Binance’s hot‑wallet management and the broader risks of permission‑based smart‑contract interactions in cryptocurrency exchanges.