Blockaid Details How EIP-7702 Exploit Targeted Binance’s Binance 14 Hot Wallet

Blockaid analysis describing how an attacker used EIP-7702 authorizations to target Binance’s Binance 14 hot wallet.

Blockchain security firm Blockaid has detailed how an attacker used Ethereum’s EIP-7702 authorization mechanism to target Binance’s Binance 14 hot wallet, submitting 50 authorizations with different nonce values to make a malicious delegation succeed. Only one authorization matched the wallet’s required nonce, enabling an unverified contract designed to transfer ETH and ERC-20 tokens from the wallet.

According to analysis reported by Wu Blockchain, the attacker could not determine the hot wallet’s live nonce before executing the transaction. The strategy was to submit multiple authorization attempts in a single Type-4 transaction, increasing the chance that one would match the account’s nonce at execution.

How the 50 EIP-7702 Authorizations Worked

EIP-7702 uses authorizations that must satisfy account nonce requirements for the authorization to take effect. In this incident, the attacker submitted 50 authorizations with nonce values ranging from 18914775 to 18914824.

Rather than relying on a single nonce value, the attacker included the full set in one Type-4 transaction. Blockaid’s analysis found that only one authorization matched successfully. That single successful authorization was sufficient to activate the malicious delegation.

The incident illustrates the specific role nonce markets matching played in the reported attack: although 49 authorizations did not succeed, the remaining one enabled the attacker’s intended contract delegation.

Malicious Contract Designed to Transfer Wallet Assets

After the authorization succeeded, the Binance 14 hot wallet’s account code was delegated to an unverified, malicious asset-transfer contract. The contract’s sweep() function is restricted to an address designated by the attacker.

According to the analysis, the function can transfer ETH and ERC-20 tokens from the wallet while retaining 1 ETH to cover gas fees. The reported mechanism therefore involves both the authorization that enabled the delegation and the contract’s ability to move assets from the affected wallet.

The contract’s access restriction is an important detail in Blockaid’s account of the incident. Only the attacker-designated address can execute the sweep() function, according to the reported analysis.

Incoming Assets May Also Be at Risk

Blockaid also warned that assets sent to the affected wallet after the malicious delegation takes effect may be vulnerable to transfer through the same mechanism. The potential exposure described in the analysis is therefore not limited to assets already held by the wallet at the time of the authorization.

The reported attack depended on an authorization financial matching the wallet’s nonce, followed by delegation to the unverified contract. The attacker’s transaction included 50 nonce values, from 18914775 through 18914824, but only one authorization succeeded.

Wu Blockchain cited Blockaid’s analysis of the incident. The reported contract can transfer ETH and ERC-20 tokens and retains 1 ETH for gas fees, while subsequent incoming assets may also remain exposed to transfer.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.

Check out other news and articles on Google News

Disclaimer:

The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.