EIP-7702 and a Tornado Cash wallet: how the Binance drain may have happened

An address funded through Tornado Cash submitted an EIP-7702 delegation for a Binance hot wallet roughly three minutes before the exchange's wallets began draining on October 29, 2026, on-chain analysis of the suspected hack shows.

The first Ethereum transaction went out at 20:24 UTC that evening: 167,464 ETH plus 63 token transfers, including 1.615 billion USDT, to a brand-new address. Outflows later appeared on Bitcoin and Tron, pushing third-party loss estimates into the billions. On-chain breakdowns of the drain put the total at $5.57 billion and climbing, with the blockchain analysis firm Chainalysis estimating $5.912 billion on October 30.

it does look like a hack on Binance.

Changpeng Zhao, Binance co-founder

What EIP-7702 delegation does

EIP-7702 is an Ethereum feature that lets an ordinary wallet run smart-contract code through a delegation. Once a wallet is delegated, that code can authorize later transfers without another signature from the wallet. That is the property on-chain analysis has focused on: one transaction in the drain carried fifty EIP-7702 authorizations signed by the Binance 14 hot wallet for consecutive nonces, an analysis shared in the security community claims. Binance has not confirmed the hack or that detail, which rests on a single researcher's reading of the chain.

Key misuse, not a stolen key

The pattern points away from a leaked private key and toward what security researchers call key misuse: a signing system that was tricked or compromised into authorizing malicious transactions. Ido Ben-Natan, co-founder and CEO of the security firm Blockaid, said the preliminary assessment points that way: It seems to be... a compromise of signing infrastructure. We don't think a key was leaked."

The distinction matters for every exchange. Stolen keys can be rotated and the damage ends; a compromised signing pipeline signs whatever it is told, as many transactions as the attacker queues. The Bybit breach of February 2025, previously the record heist at roughly $1.5 billion, followed a similar shape, and the same question now applies across the industry's signing systems. It is the same weak point Google flagged when arguing banks need key-splitting custody: 40% of hack losses start with keys.

How the attacker obtained the signature, whether through key access, compromised infrastructure or insider action, remains unknown. Binance suspended all deposits and withdrawals as a precaution and said it will cover all losses, while issuers froze billions in stolen stablecoins within hours.

We are working non-stop to resolve this issue. Binance will cover all losses.

As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.

We are working around the clock and will... pic.twitter.com/zufWJ6V05D

- Binance (@binance) October 30, 2026

Binance's verified frozen total stood at around $3 billion as of October 30.

The post EIP-7702 and a Tornado Cash wallet: how the Binance drain may have happened appeared first on Techreport.