A fresh on-chain analysis is shedding light on how one of the largest cryptocurrency thefts in history unfolded around Binance's hot-wallet system. According to security firm Blockaid, an attacker submitted a single Ethereum type-4 transaction carrying 50 EIP-7702 authorizations, each one betting on a different nonce until one matched the active nonce of the exchange's hot wallet, identified as Binance 14.

The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit. A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed.

— Blockaid (@blockaid_) October 29, 2026

The firm's analysis details how a narrow timing window, combined with the wallet's ongoing activity, allowed a single authorization to succeed. The attacker did not need to identify one exact nonce in advance; the group of 50 authorizations created a range in which one could match while Binance 14 continued transacting. Blockaid has estimated that at least $5.5 billion was lost in the wider incident.

50 EIP-7702 Authorizations Produced One Successful Hit

At 20:20:59 UTC on Oct. 29, the attacker submitted 50 authorizations covering nonces from 18,914,775 to 18,914,824. Binance 14 was still processing withdrawals at the time, which meant its nonce was fluctuating. The attacker did not know the exact value of the live nonce, only that it fell somewhere within that range.

Of the 50 authorizations, 49 were invalid and only one was accepted, Blockaid reported. The successful authorization delegated Binance's wallet to an attacker-controlled sweeper contract. Because an EIP-7702 authorization is valid only for the current nonce at the time of inclusion, the strategy depended on the wallet remaining active — and as Binance 14 continued firing transactions, one nonce in the sprayed window landed. The attacker then invoked the sweeper contract and drained the wallet approximately three minutes later.

EIP-7702 Turned the Hot Wallet Into a Programmable Account

EIP-7702 extends Ethereum's capabilities by allowing an externally owned account to temporarily act as a smart-contract account, delegating execution to code. In this instance, the delegated contract carried very broad functionality, including the ability to transfer tokens and ETH out of the wallet.

In the first major sweep, Blockaid recorded the transfer of approximately 167,464 ETH, 1.615 billion USDT, and dozens of other tokens, valued at around $2.5 billion at the time of writing. The delegation remained in place afterward, which could eventually allow additional funds to be swept from the wallet without requiring any further authorization.

The Binance Incident Expanded Beyond a Single Wallet

The attack on Binance appears not to have ended with the initial drain. According to Blockaid, other Binance-controlled wallets transferred funds to addresses associated with the same operation on Ethereum, Optimism, Arbitrum, and Avalanche. Other public estimates also identified outflows of Bitcoin and funds on Tron tied to the attack.

The full extent of the damage is expected to become clearer as the incident continues to unfold, but Blockaid's latest tally put total losses at no less than $5.5 billion.

Binance announced that it is aware of an "eventual security breach" and is investigating how it occurred, without making the details public. The exchange stated that user funds are secure.

More Than $2.5B in Crypto Has Already Been Frozen

The suspicious transfers prompted stablecoin issuers and other industry players to act swiftly. As of Oct. 29, Binance reported that more than $2.54 billion in assets connected to the incident had been frozen. Nearly $1.57 billion of that amount was frozen by Tether, while more than $800 million was frozen by Circle. Crypto companies such as Ripple also took part in the freezing of assets.

The incident has placed EIP-7702 in the spotlight once again, particularly because it did not require breaking Ethereum itself. Rather, a valid authorization allowed an attacker-controlled process to take over the execution of a hot wallet.

Soon after the first sweep, Blockaid detected the malicious delegation and identified the EIP-7702 mechanism within minutes, the firm said.