flash on Nostr: ⚡️🚨 MORE - How did a hacker manage to take control of a Binance hot wallet ...
⚡️🚨 MORE - How did a hacker manage to take control of a Binance hot wallet containing billions of dollars?
The cybersecurity firm Blockaid has revealed a particularly sophisticated method that exploits Ethereum’s EIP-7702 mechanism.
The hacker had 50 signed authorizations allowing him to delegate control of the “Binance 14” wallet to a malicious contract.
But each authorization had to match the correct nonce—a counter that changes with every transaction. So he submitted all 50 possibilities simultaneously. Forty-nine failed; only one worked.
That single authorization allowed him to take control of the wallet and drain it remotely.
Within just 3 minutes of the delegation, 167,464 $ETH, 1.615 billion USDT, and dozens of other tokens were stolen—totaling approximately $2.5 billion.
But what’s most concerning is that the malicious contract also allowed the hacker to retrieve any new incoming funds.
More than an hour after the first transfer, he was thus able to steal an additional 200 million USDT and 13 other tokens.
Published at
2026-10-30 08:17:35 UTCEvent JSON
{
"id": "7759223db4ba1422776096bcbe6fb9ff04315a3ce1bd69c97900c8b5f576c0e5",
"pubkey": "4d7842051782e0d3feb034d150adc2b6bae4ee3b49786793bffa468b6f5b96b3",
"created_at": 1793348255,
"kind": 1,
"tags": [
[
"client",
"Primal iOS"
]
],
"content": "⚡️🚨 MORE - How did a hacker manage to take control of a Binance hot wallet containing billions of dollars?\n\nThe cybersecurity firm Blockaid has revealed a particularly sophisticated method that exploits Ethereum’s EIP-7702 mechanism.\n\nThe hacker had 50 signed authorizations allowing him to delegate control of the “Binance 14” wallet to a malicious contract.\n\nBut each authorization had to match the correct nonce—a counter that changes with every transaction. So he submitted all 50 possibilities simultaneously. Forty-nine failed; only one worked.\nThat single authorization allowed him to take control of the wallet and drain it remotely.\n\nWithin just 3 minutes of the delegation, 167,464 $ETH, 1.615 billion USDT, and dozens of other tokens were stolen—totaling approximately $2.5 billion.\n\nBut what’s most concerning is that the malicious contract also allowed the hacker to retrieve any new incoming funds.\n\nMore than an hour after the first transfer, he was thus able to steal an additional 200 million USDT and 13 other tokens. \nhttps://blossom.primal.net/d75a5922401d8b392949e618330a47fe15da2a90a303980d212a8fdebc1ab8c0.jpg",
"sig": "88fbe01b5e75f6d8d08e002175f58264af10ebcb69a3232dad3fda6e89299a60b513d0a209c3a98d5d84e37a62522787bc60987bb693394cf60251d6e29c5a2e"
}
