Cardano founder Charles Hoskinson has warned about dangerous code circulating after the Binance wallet breach, sharing a third-party technical analysis of the incident. The report links Ethereum's EIP-7702 delegation feature to the rapid transfer of assets, although the exchange has not confirmed how attackers obtained signing authorization.

In an X post on October 30, Hoskinson cautioned that “there is some seriously dangerous code out there.” He shared a technical account by CyberSatoshi describing a contract allegedly designed to empty a busy exchange hot wallet — an internet-connected account exchanges rely on to process customer withdrawals and deposits:

Careful, there is some seriously dangerous code out there. pic.twitter.com/w7wM1nn0Lz — Charles Hoskinson (@IOHK_Charles) October 30, 2026

The loss caused by the wider attack on October 29 was pegged at $6.3 billion, according to Bloomberg. The company's announcement on October 30 indicated that investigators had not come across any stolen private keys.

What Did the Analysis Find in Binance's Wallet?

According to CyberSatoshi, the contract contained a function that swept funds and left only one ETH behind, ensuring that the payment process did not fail due to a lack of gas.

This theory about how the alerts worked inside the exchange has not yet been verified, and Binance has not confirmed the information. The contract allegedly checked the balance of each token and proceeded regardless of whether an individual transaction failed, meaning other tokens could still be processed even if one was restricted.

The analysis also identified an execute function that accessed a wallet holding roughly $823 million worth of USDC tokens. That wallet allegedly recognized the restricted hot wallet known as Binance 14 as an authorized controller. Blockchain experts have discussed the findings, but it remains unclear what effect this had, and the account does not show how the original signatory gained the permissions.

How Does Ethereum's EIP-7702 Delegation Work?

EIP-7702 enables any account on the Ethereum protocol to use other addresses' code for delegation, a capability intended to bring smart-contract functionality to ordinary user accounts. The standard supports batch transactions and third-party payment of fees. Its permissions consist of a chain identifier, the delegate's address, transaction nonces, and signatures. Once these parameters are verified, the code is assigned to the account.

This means the attack could not have happened through EIP-7702 alone: the attacker must have held valid signing permission. According to CyberSatoshi, the attacker either had access to the private key or was able to obtain unrestricted permissions. According to Binance, however, no such leakage of private keys was found.

Why Were 50 Authorizations Submitted?

The researcher identified a set of 50 signatures for authorizations with consecutive nonces. A nonce is a value that changes each time an account makes a transaction. Because Binance 14 is known to handle frequent transfers, the attacker reportedly generated multiple records corresponding to its varying nonces.

Blockchain investigation shows that one authorization corresponds to the wallet's current nonce and initiates the delegation process. Ethereum executes each authorization in sequence while skipping those that fail validation, and several consecutive authorizations may succeed provided their nonces are correct at the moment of processing. In the case in question, according to various sources, there was only one corresponding entry. The next delegated action transferred large amounts of tokens through a single transaction.

According to CyberSatoshi, that speed left Binance little time to react. Unlike card payments, which include chargeback mechanisms, blockchain transfers have no built-in reversal once a transaction is confirmed. However, the claim that the movement could have been detected early through normal transactions is questionable.

What Security Risks Does EIP-7702 Identify?

According to Ethereum's specifications, delegated code can access an account without additional restrictions, and the standard recommends that auditors of wallet developers review the contract and prevent replay attacks.

Delegation persists even after the transaction that sets up the delegation completes. An authorization that has been processed is not simply deleted, even if the delegation's execution subsequently fails. An authorization naming the zero address deletes the delegation, meaning delegated access stays in force until it is explicitly revoked.

Binance has confirmed that it already revoked the affected authorizations and increased its security measures. The firm has assured customers that losses will be compensated and that a technical report will be released. How the signing access was obtained remains an open question, and the matter of access control still requires investigation — making the exchange's promised technical report the next document to watch for answers.