Binance Says Hot Wallet Funds Were Moved in $6.3 Billion Security Incident

Binance said funds worth about $6.3 billion were moved from its hot wallets in a security incident the exchange disclosed on its official support announcement. The exchange’s statement confirms the scale of the movement, while later technical commentary from security researchers has helped fill in some of the mechanics behind how the drain unfolded.

According to Blockaid security firm researcher Tom G, the attacker used a copied key to pre-sign 50 EIP-7702 authorizations on a Binance hot wallet. One of those authorizations matched, which then allowed sweeps of roughly $2.5 billion in ETH, USDT and other tokens across multiple nonces, the researcher said in a post on X.

The security firm also said rotating the key did not stop the activity. Blockaid said it worked with Binance on tracing and freezing efforts after the incident.

How the wallet drain worked

EIP-7702 is an Ethereum account delegation mechanism, and in this case it appears to have been part of the path that let the attacker’s code interact with Binance’s hot wallet system. The description shared by Blockaid points to a pre-signed authorization model rather than a simple one-time transfer, which helps explain why the activity could continue across multiple nonces once the valid authorization was accepted.

Binance’s announcement did not describe the attack in those technical terms, but it did confirm that funds were affected through the exchange’s hot wallets. The incident has also been described by some observers as the largest crypto hack reported so far, though that characterization comes from secondary commentary rather than Binance’s own statement.

At this stage, the most concrete facts are the exchange’s confirmation of the incident, the reported scale of the movement and the security analysis outlining the EIP-7702 delegation path. Further details on attribution, recovery and the full scope of assets affected were not included in the exchange’s initial post.