Binance’s $630 Million Hack May Be Exacerbated by EIP‑7702 Upgrade
Current overview (not historical)
Binance confirmed a $630 million hack, the largest ever recorded for the exchange. According to Ido Ben‑Natan, co‑founder of Blockaid, attackers likely exploited compromised engineer computers to gain access to Binance’s wallet‑signing infrastructure and coerced signers into approving malicious transactions. After the launch of EIP‑7702, security concerns have intensified. Early reports indicated that the upgrade’s delegation feature could route funds to malicious contracts, enabling automatic withdrawals. VEER noted that EIP‑7702 effectively provides attackers with a “one‑click withdrawal” capability. While the upgrade itself did not directly cause the breach, it may have amplified the losses by simplifying the process for attackers to siphon funds.
Written with AI from the reporting · updated 10/30/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 30, 00:00recorded Oct 30, 19:46single sourcerevised
EIP-7702可能加剧Binance6.3亿美元损失
Read original source ↗ CointelegraphReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Binance
- Action：
- 确认6.3亿美元黑客攻击并发现更多违规点
- Object：
- Binance热钱包签名基础设施
- Occurred (fact side)：
- Oct 30, 00:00
- Published (valid side)：
- Oct 30, 19:00
- First seen (known side)：
- Oct 30, 19:46
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CointelegraphRelated fact: single sourceSource report revisedBinance’s $6.3 B Hack Likely Enabled by Compromised Signing System, Not EIP‑7702
Report first recorded Oct 30, 19:46
Binance confirmed a $6.3 billion loss, the largest in crypto history, after attackers accessed its wallet‑signing infrastructure. Blockchain security firm Blockaid’s co‑founder Ido Ben‑Natan said the breach likely began with a compromised engineer’s laptop, allowing the attackers to sign malicious transactions. While Ethereum’s EIP‑7702 upgrade—introduced in May 2025 to enable bundled transactions and sponsored gas—was not the root cause, Ben‑Natan argued it could have helped attackers execute the theft in a single sweep, bypassing additional security checks. Binance’s investigation revealed multiple breach points beyond the initial laptop compromise. EIP‑7702 had already faced security concerns, with early delegations pointing to malicious contracts that drained wallets, and later incidents involving WLFI token holders. Experts warn that similar signing‑system attacks could threaten other exchanges, and that transaction simulation could detect malicious requests before approval.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 30, 20:00
- 24h change
- -50%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.