EIP-7702 Upgrade Exploited in $6.4 Billion Binance Hot Wallet Hack Across 10 Chains
Current overview (not historical)
On October 29, 2026, hackers exploited the EIP-7702 code delegation feature to convert Binance hot wallets into sweeping contracts, draining approximately $6.4 billion across 10 blockchains within a 20-minute window. A wallet that submitted a signature authorization via Tornado Cash enabled the hot wallets to execute attacker-deployed code, after which the attacker transferred assets to controlled addresses. On the same day, Tether froze over $1.5 billion in USDT. The FBI attributed the attack to the North Korean hacking group TraderTraitor.
Written with AI from the reporting · updated 11/2/2026
Related events
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 29, 00:00recorded Oct 30, 22:27revised
EIP-7702 升级导致 Binance 热钱包被盗 6.4 亿美元
Read original source ↗ PANews · ArticlesReplay this moment in the explorerEvidence & revisions · 2 source records
- Subject：
- Binance
- Action：
- 热钱包被黑客通过 EIP-7702 代理功能控制并转移资产
- Object：
- Binance 热钱包资产
- Occurred (fact side)：
- Oct 29, 00:00
- Published (valid side)：
- Nov 2, 09:00
- First seen (known side)：
- Nov 2, 09:54
- Published (valid side)：
- Oct 30, 22:17
- First seen (known side)：
- Oct 30, 22:27
Fact stationRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 2Unclassified fact stationOct 31, 00:00recorded Oct 31, 23:17single sourcerevised
Binance hack: $6.4 billion stolen in largest crypto heist
Read original source ↗ DecryptReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- Binance
- Action：
- funds stolen
- Object：
- hot wallets across 10 blockchains
- Occurred (fact side)：
- Oct 31, 00:00
- Published (valid side)：
- Oct 31, 23:01
- First seen (known side)：
- Oct 31, 23:17
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
- 3Unclassified fact stationDec 23, 00:00recorded Nov 2, 12:55single source
美国FBI通告指TraderTraitor朝鲜黑客窃币安63亿美元
Read original source ↗ PANews · ArticlesReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- TraderTraitor
- Action：
- 归因窃币安63亿美元
- Object：
- 币安热钱包
- Occurred (fact side)：
- Dec 23, 00:00
- Published (valid side)：
- Nov 1, 13:53
- First seen (known side)：
- Nov 2, 12:55
Fact stationSingle source · one-sided claimCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- PANews · ArticlesSelectedEIP-7702 upgrade enables Binance hot wallet hack, resulting in $64 million theft
Report first recorded Nov 2, 09:54
The EIP-7702 upgrade, activated on Ethereum in May 2025, allows standard externally-owned accounts to temporarily use smart contract code. On October 29, 2026, attackers exploited this feature to convert a Binance hot wallet into a sweeper, transferring approximately $64 billion across 10 blockchains in about 20 minutes. Blockchain analysts TRM Labs and Chainalysis attributed the hack to the TraderTraitor group linked to North Korea. The attack involved pre-signed delegations that allowed the attacker's code to control the wallet's funds.
Read original source ↗
- PANews · ArticlesSelectedRelated fact: single sourceUS FBI links $63M Binance hack to TraderTraitor, exposes North Korean hacker network
Report first recorded Nov 2, 12:55
The US FBI attributed the October 29 Binance hack to TraderTraitor, a North Korean hacking collective. The group has stolen at least $6.3 billion from Binance, $1.5 billion from Bybit, and $388 million from Bitget since 2020, targeting crypto platforms and wallets via phishing, supply chain attacks, and front-end manipulation. TRM reports North Korean hackers have conducted over 100 attacks since 2017, stealing approximately $12.8 billion in total.
Read original source ↗
- DecryptSelectedRelated fact: single sourceSource report revisedBinance hacked for $6.4 billion in largest crypto heist ever, CEO says
Report first recorded Oct 31, 23:17
Attackers stole roughly $6.4 billion from Binance on Thursday, the largest crypto hack in history, using a compromised DevOps engineer's laptop to access hot wallets across 10 blockchains. Binance says it will cover all losses with company funds and its emergency reserve, stating customer assets were never touched. The hack was attributed to North Korean group TraderTraitor, who used a self-destruct mechanism and EIP-7702 to drain assets.
Read original source ↗
- DecryptSource report revisedEIP‑7702 Upgrade Enables Smart‑Contract Features for Standard Wallets, Used in $6.4 B Binance Hack
Report first recorded Oct 30, 22:27
EIP‑7702, activated with the Pectra upgrade on May 7 2025, lets externally owned accounts temporarily adopt smart‑contract code via a "set code" transaction. The transaction records a signed delegation to a contract, after which the account runs that contract’s code with full access to its funds until a new delegation is signed. In October 2026, attackers exploited this feature to convert a Binance hot‑wallet into a malicious contract and drained roughly $6.4 billion across ten chains in about 20 minutes, a theft attributed to North Korean actors. The incident demonstrates how a protocol upgrade intended to enhance wallet flexibility can be weaponised when combined with sophisticated attack vectors.
Read original source ↗
Event activity trend
- Latest comparable
- 0
- Comparable peak
- 10Oct 30, 23:00
- 24h change
- –
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.