Onchain records show that delegated wallet permissions linked two Binance-labeled Ethereum accounts in a suspected security incident, after code installed on one wallet enabled an outside address to move assets from it and from a second smart wallet. The "Binance" labels come from Etherscan's tagging system and do not by themselves constitute confirmation from the exchange. The records establish the sequence of transfers but do not show whether the movements were authorized, or whether Binance or its customers suffered a loss. The Defiant reported the sequence in its account of the suspected incident.

Binance said it was investigating the suspected incident and that withdrawals would resume once the issue was resolved.

Delegation Installed, Wallet Swept Within Minutes

An Ethereum account labeled by Etherscan as "Binance 14" transferred approximately 167,464 ETH and 1.615 billion USDT on Oct. 29. The account had installed an EIP-7702 delegation, and a different address submitted the call that moved the assets.

The authorization transaction installed the delegation at 4:20:59 p.m. ET. Three minutes and 24 seconds later, at 4:24:23 p.m. ET, the outside address called the wallet's sweeping function. That transaction recorded 63 ERC-20 transfers alongside the ETH movement, including the USDT.

A Second Smart Wallet Drained

The same sender called the delegated wallet again at 4:41:23 p.m. ET. That call triggered 780 million USDC to move from a separate Binance-labeled smart wallet to the same recipient. Whale Alert flagged the movement as a transfer from Binance to an unknown wallet.

The token source was the contract labeled "Binance: Hot Wallet 34," not Binance 14. Etherscan's read-only contract interface identifies Binance 14 as the smart wallet's owner, and the execution trace shows Binance 14 calling the smart wallet, which then called the USDC contract to transfer the tokens. The records therefore connect the two movements through a shared caller and recipient, while leaving authorization and any loss unresolved.

The address that submitted the calls also created the delegate contract. It had received about 0.0983 ETH from a Tornado Cash pool on Oct. 28. The source reports that transaction detail but does not establish who controlled the address or why it received the funds.

What the Delegation Allowed

EIP-7702 lets an ordinary, key-controlled Ethereum wallet execute code stored at another address. The feature went live on Ethereum mainnet as part of the Pectra upgrade in May 2025. Installing a delegation requires a signature from the wallet's key, and intended uses include batching operations and letting someone else pay transaction fees.

Once installed, the delegation persists beyond the transaction that set it up. Later callers can trigger whatever actions the delegated code permits without necessarily obtaining a fresh signature from the wallet's key. Phylax Systems founder Odysseus described the sequence in a thread: "The delegation persists; that code can authorize later transfers without another signature from the wallet."

The EIP warns that delegated code has "unrestricted access to the account" and says wallets must closely audit it. A delegation can be replaced or cleared with a new signed authorization, and the protocol specifically supports clearing it by authorizing the zero address.

Related Security Coverage

Separate reporting on crypto theft has examined a distinct security failure: Bitget's account of a zero-day theft describes unauthorized withdrawals linked to a flaw in third-party security products. Another case shows how outcomes can turn on evidence — a South Korean court acquitted a crypto influencer after finding prosecutors had not proved how his actions affected the token. Those reports concern different events. Questions about insurance coverage after a Binance hack can likewise turn on policy terms, exclusions and how a breach occurred; that analysis does not establish coverage for this incident.

Binance's investigation and its statement on withdrawals remain the stated next steps. From here, the concrete things to watch are narrow: whether withdrawals resume once the company says the issue is resolved, whether the delegation on Binance 14 is replaced or cleared with a new signed authorization, and whether any further movements touch the labeled accounts. The available transaction records explain how delegated code reached assets in a second account, but they do not resolve who authorized the activity or whether any customer funds were lost.