How the Binance hack happened on-chain on Ethereum

The Binance hack is one of the largest heists of all time and relied, in part, on exploiting how wallet delegation functions on Ethereum.

Specifically, the attacker appears to have deployed a sweeper contract and then sent 50 EIP-7702 authorizations targeting the address labeled as Binance 14, all signed with the Binance 14 key.

It had to send a wide variety of approvals with different ‘nonce’ values because this was a hot wallet in rapid use, and for the delegation to be approved, the ‘nonce’ value (think of it as related to a count of the number of transactions the wallet has done) in the authorization transaction had to match the current ‘nonce’ value for the adddress.

After this was approved, the sweeper contract was then run as if it was the Binance 14 account and was able to sweep the Binance 14 ether and tokens.

However, interestingly, other wallets outside of Binance 14 did not rely on this delegation, and the delegation was primarily for convenience since the attacker was able to sign with the Binance 14 key.

Protos continues to follow the incident closely, and you can find live updates in the post above.

Binance 16, for example, was able to send its hacked funds on Ethereum through a normal transaction, instead of through this type of delegation.

Other Ethereum Virtual Machine (EVM) chains, like Base, Optimism, Arbitrum, Avalanche, and Polygon also relied on mundane transfers rather than the delegation.

Binance was eventually able to remove the delegation from Binance 14, and approximately $2.4 billion worth of funds removed from Binance wallets on Ethereum have been frozen or blacklisted.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post How the Binance hack happened on-chain on Ethereum appeared first on Protos.