Cyber attackers have made off with a staggering $6.34 billion in cryptocurrencies from Binance, one of the world’s largest digital currency exchanges, by exploiting a known weakness in Ethereum smart accounts. The breach highlights the ongoing struggle for cryptocurrency firms to secure their assets and underscores the importance of robust security controls.
The attackers used a feature called EIP-7702 authorization, which allows users to delegate permissions to manage funds on a wallet. However, this feature can also be exploited by malicious actors to install “sweepers,” which are pieces of code that siphon off funds from an account without the owner’s knowledge. In Binance’s case, the attackers deployed sweepers to drain multiple wallets containing over $2.5 billion in various cryptocurrencies.
The breach was particularly concerning because it demonstrated how easily a malicious actor can compromise an exchange’s security controls. According to Ido Ben-Natan, co-founder and CEO of blockchain security firm BlockAid, EIP-7702 authorizations are essentially standing delegations that allow attacker-controlled code to move funds from a hot wallet until the authorization is revoked. “It carries no amount and no destination, so withdrawal controls never see it,” he explains.
Binance’s internal security systems did detect suspicious activity within minutes of the attack, but the attackers had already exploited the EIP-7702 authorization to install sweepers that continued to transfer funds for several hours. The company took countermeasures, including suspending withdrawals and shutting down hot wallet services, but these measures did not immediately invalidate existing on-chain authorizations.
The breach highlights a disturbing trend in cryptocurrency attacks: the targeting of developers as an initial point of entry. In Binance’s case, two developers were compromised by malware-laced software, while a third developer was tricked into installing malicious code through a fake job interview. This vulnerability is not unique to Binance; Avi Sambira, vice president of North America at incident-response firm Sygnia, notes that the same tactics were used in a previous Ethereum heist.
The takeaways from this breach are clear: cryptocurrency firms must prioritize robust security controls and educate their developers about potential threats. This includes implementing measures to detect and prevent EIP-7702 authorization attacks and ensuring that all systems are up-to-date with the latest security patches. Furthermore, exchanges must invest in secure development practices and conduct regular security audits to identify vulnerabilities before they can be exploited.
For individual investors and users of cryptocurrency exchanges, this breach serves as a reminder of the importance of due diligence when it comes to security. By staying informed about potential threats and taking steps to protect their assets, investors can minimize their risk exposure and avoid falling victim to these types of attacks.
Source: Dark Reading — 2026-11-13