Binance Wallet Attack via EIP-7702

The attacker exploited a vulnerability in the Ethereum protocol to temporarily seize control of the Binance wallet. The attack was carried out using the EIP-7702 mechanism, which is part of the Pectra update.

Attack Mechanism

EIP-7702 allows a standard external account (EOA) to temporarily act as a smart contract if it has a signature from the private key. The attacker obtained such a signature and configured delegation to their own fund-collecting contract.

After gaining control, the hacker withdrew assets, including ETH and significant amounts of stablecoins. This allowed them to quickly liquidate the stolen funds before the network could react.

Nonce Spoofing Strategy

To increase the likelihood of a successful attack, the attacker pre-prepared about 50 authorizations with sequential nonce values. Not knowing the exact current value, they sent the batch of transactions all at once.

The Ethereum network accepted only the transaction whose nonce matched the expected value at the time of execution. All other requests were automatically discarded as irrelevant.