Binance Hack in October 2026: How an EIP-7702 Exploit Drained Billions From Hot Wallets
Introduction
A major security incident involving Binance hot wallets on October 30, 2026, has raised questions about the risks of EIP-7702, transaction-signing infrastructure, and cross-platform security coordination. The incident involved a series of EIP-7702 authorization requests that reportedly enabled unauthorized asset transfers from Binance-linked wallets. Early on-chain estimates put the value of assets moved across several networks at approximately $5.8 billion, although this figure should not be confused with Binance's confirmed net loss.
The incident highlights an important distinction: EIP-7702 is an Ethereum protocol feature designed to support smart-account functionality, not a vulnerability that automatically exposes every wallet using it. The reported failure appears to have involved the signing and authorization process. Binance said it would cover the losses, temporarily paused deposits and withdrawals, and began security checks. Meanwhile, stablecoin issuers and blockchain ecosystem participants took steps to freeze or secure assets linked to the incident.
How Did the October 2026 Binance Hot Wallet Incident Happen?
The reported attack involved unauthorized EIP-7702 authorizations signed by a Binance hot wallet, allowing attacker-controlled code to initiate transfers of assets. The available on-chain analysis points to a failure in the transaction-signing process, although Binance had not published a final technical investigation when the initial reports appeared.
According to the analysis made by Bitfish, Cobo's co-founder, the incident began at approximately 4:20 a.m. UTC+8. A transaction containing 50 authorization requests was broadcast on-chain. The requests were signed using the private key associated with a Binance hot wallet. A few minutes later, assets began moving out of the wallet in batches.
The analysis described an authorization program with a narrowly defined function: it recognized a designated controller and executed asset transfers. The 50 requests carried sequential transaction nonces, allowing the authorizations to take effect when the sequence matched the wallet's current state. The report also described two test transactions conducted before the main operation, suggesting that the attacker had prepared the transfer process in advance.
How Did EIP-7702 Enable the Unauthorized Transfers?
EIP-7702 allows an externally owned account (EOA) to temporarily adopt smart-contract functionality by authorizing a designated code address. The feature was introduced as part of Ethereum's Pectra upgrade and is intended to support more flexible account behavior, including improved wallet experiences and programmable transaction execution.
Under EIP-7702, an account signs an authorization that designates code to execute in the account's context. This can enable functions such as batched operations and more sophisticated transaction flows. However, the authorization is security-sensitive: if a user or wallet signs an unintended authorization, the designated code may gain the ability to perform actions that the signer did not intend.
In the Binance incident, the reported concern was not that EIP-7702 itself had been broken. Instead, the available analysis suggested that the signing system may have approved an unauthorized set of requests. Blockaid CEO Ido Ben-Natan said the incident may have originated from a compromised signing system rather than a direct theft of the private key. Binance had not confirmed the precise attack path in the cited report.
This distinction is important. A private key can remain in the platform's custody while a compromised signing workflow is manipulated into approving a malicious transaction. Security controls must therefore verify not only who or what signs a transaction, but also whether the transaction's destination, authorization scope, code, and intended effect are legitimate.
How Much Was Transferred?
Early estimates based on on-chain movements put the total value of assets transferred across multiple networks at approximately $5.8 billion, but the amount moved is not necessarily the final economic loss. Asset prices fluctuate, some transfers may be frozen, and the incident's full scope requires confirmation from Binance and the relevant investigators.
The same Bifish's analysis described large transfers involving ETH, USDT, USDC, and other tokens. It also reported that assets moved across Ethereum and Tron, while a separate Bitcoin wallet movement remained unconfirmed as to whether it was connected to the incident or represented an emergency transfer by Binance. That distinction matters because an on-chain transfer alone does not prove that an asset was stolen.
The analysis further described rapid conversion activity as the attacker attempted to move assets that could potentially be frozen by stablecoin issuers into assets with different control characteristics. Tether, Circle, and other issuers reportedly froze some related tokens as the incident response developed. These early figures should be treated as evolving estimates, not a final audited loss statement.
How Did Binance Respond to the Security Incident?
Binance's immediate response included suspending deposits and withdrawals, conducting security checks, tracing affected assets, and coordinating with other industry participants. The exchange also stated that it would cover the losses attributed to the incident, while emphasizing that customer funds remained safe.
According to Binance co-CEO Yi He, Binance temporarily suspended deposits and withdrawals while its teams investigated the incident, worked to freeze related assets, and coordinated with law enforcement. Yi He said the company would assume the full losses caused by the attack and would publish a detailed incident review after the investigation was completed. She also advised users to rely on information from Binance's official channels.
The temporary service suspension was a precautionary security measure. Restricting deposits and withdrawals during an active investigation can help the platform assess wallet integrity, review transaction-signing systems, and reduce uncertainty while teams trace suspicious transfers. It can also inconvenience users who need to move assets, which makes timely and clear communication important.
What Did Binance Say About Customer Funds?
Binance stated that user funds remained safe and that it would cover the losses resulting from the incident. This was a company assurance and compensation commitment, rather than a substitute for a completed technical investigation or an independently verified accounting of the final loss.
Yi He said Binance was conducting security scans to verify the safety of user funds. She also referred to the progress made by other industry participants in freezing assets associated with the incident and called on First Digital to assist with the remaining FDUSD identified in the response effort.
Binance's public position therefore had three parts: protect customer balances, investigate the signing and wallet systems, and coordinate with external parties to contain the movement of affected assets. The company said it would provide a fuller account once the investigation was complete. Until that report is published, the exact technical cause and final financial impact should be treated as unresolved.
How Did Other Crypto Companies and Protocols React?
The incident prompted a coordinated response from stablecoin issuers, DeFi risk teams, and blockchain ecosystem participants. Their actions included freezing assets, restricting activity in lending markets, and moving tokens associated with affected addresses into controlled storage.
Why Did Aave Freeze Markets?
Aave's risk response focused on limiting potential exposure through its lending markets. According to reports, LlamaRisk, Aave Labs, and other participants decided to use guardian controls to freeze a large number of markets while monitoring the attacker's addresses and relevant price feeds.
The reports said the action covered 175 reserve types across 16 networks on Aave V3, as well as 117 reserves across four spokes in Aave V4. Aave indicated that markets would be considered for phased reopening after the movement of affected funds had stabilized and the relevant risks had been assessed.
Freezing markets can limit additional lending and borrowing activity involving assets that may be exposed to a security incident. It is a risk-containment measure, not a declaration that every asset or user connected to the protocol has been compromised. The temporary restrictions can also affect normal users, which is why monitoring and a controlled reopening process are important.
What Did Arbitrum Do With the Related Assets?
Arbitrum's Security Council took action to secure assets associated with the incident that were held on Arbitrum One. According to the report, the council moved 74,559,805 ARB and 8,425 ETH from addresses linked to the incident into an intermediary holding wallet.
Arbitrum said the operation was conducted after technical review and consideration of the network's security and governance responsibilities. The report stated that the action did not affect other Arbitrum users or applications, and that the assets could only be moved again through further Security Council action or an Arbitrum DAO governance vote.
This response illustrates how a blockchain ecosystem may use governance and emergency security mechanisms to protect assets in a specific incident. It also raises important questions about the balance between rapid intervention, user ownership, decentralization, and transparent governance. Such actions should be assessed in the context of the protocol's published rules and the circumstances of the incident.
How Will Binance Compensate Users for the Losses?
Binance said it would assume the full financial losses caused by the incident, meaning affected customer balances would not be left to absorb the shortfall if the company's commitment is fulfilled. The compensation statement was made by co-CEO Yi He on October 30, alongside the temporary suspension of deposits and withdrawals.
Binance committed to covering all losses resulting from the security incident. The company also said it was working to freeze related assets and cooperating with law enforcement. A complete incident review was expected after the investigation.
There are two separate financial questions to consider. The first is the value of assets transferred from the affected wallets. Early on-chain estimates put the amount at approximately $5.8 billion across several networks. The second is the net loss after accounting for frozen assets, recovered funds, and any assets that remain inaccessible to the attacker. These figures should not be treated as interchangeable.
The ability to freeze assets may reduce the final financial impact, but it does not automatically mean that every transferred token has been returned to Binance. Some assets may remain in controlled wallets while the relevant parties complete their procedures. Binance's commitment to cover the losses is therefore significant for customer protection, but the final reconciliation and implementation details matter.
Users should follow Binance's official announcements for information about service restoration, account balances, and the final incident report. They should not rely on unofficial messages claiming to offer compensation, wallet recovery, or special account verification. A genuine compensation process should be communicated through the platform's established channels.
Conclusion
The October 2026 Binance security incident exposed the operational risks that can arise when transaction-signing systems interact with powerful wallet authorization features such as EIP-7702. Early on-chain analysis described 50 authorization requests and large asset transfers from Binance-linked hot wallets. However, the precise attack path and final net loss remained subject to investigation.
Binance responded by suspending deposits and withdrawals, conducting security checks, coordinating with external parties, and committing to cover the losses. Stablecoin issuers froze related assets, Aave restricted activity across numerous markets, and Arbitrum's Security Council moved associated assets into a controlled wallet. These actions demonstrated the importance of rapid coordination across the digital-asset ecosystem.
The broader security lesson is that private-key protection must be supported by transaction-level verification, strict authorization controls, independent signing approval, continuous monitoring, and tested incident-response procedures. EIP-7702 is a protocol feature with legitimate account-abstraction use cases, but its security depends on how wallets and applications implement it. Exchanges, developers, and users all have a role in reducing the risks associated with increasingly programmable wallets.
FAQs
1. Was Binance's October 2026 incident caused by a vulnerability in EIP-7702 itself?
The available reports pointed to a possible failure in Binance's transaction-signing process rather than a confirmed flaw in the EIP-7702 protocol. Binance had not published a final technical investigation in the cited updates, so the precise root cause remained unconfirmed.
2. What is EIP-7702 in simple terms?
EIP-7702 is an Ethereum improvement proposal that allows an externally owned account to delegate execution to designated smart-contract code through a signed authorization. It supports more flexible wallet functionality, but users and platforms must carefully verify the code and permissions involved.
3. Did Binance say it would compensate affected users?
Yes. Binance co-CEO Yi He said on October 30, 2026, that Binance would cover all losses resulting from the incident. The company also said it was investigating the event and would publish a fuller review after the investigation.
Disclaimer
This general market information, possibly from third-party, commercial, or sponsored sources, is provided for reference and educational purposes only and does not constitute financial or investment advice, an offer, solicitation, or guarantee. We disclaim liability for its accuracy, completeness, reliability, and any resulting losses. Investments/trading are risky; past performance doesn’t guarantee future results. Users should research, judge prudently, and take full responsibility. For further details, please consult KuCoin’s Terms of Use and Risk Disclosure.