Binance Hack Puts Ethereum’s EIP-7702 and Exchange Custody Under Scrutiny

Binance’s account of the attack

Binance co-CEO Richard Teng says the cryptocurrency industry should study the attack described as the $6.3 billion Binance hack. Speaking to CNBC on Tuesday, he said Binance had published a detailed report so other industry participants could learn from what happened. His account portrays the incident not as a single, sudden breach, but as a campaign that developed over months and reached the system authorizing wallet transactions.

Teng cited an FBI attribution to North Korea and described a sequence that began in June with a fake developer tool. In September, he said, the attackers used fake recruiter interviews. The account then traces their progress through internal AI tools to the system used to authorize wallet transactions. These details suggest the attack’s reported path crossed several parts of Binance’s operations before the cryptocurrency transfer was enabled.

The incident highlights how a technical feature can be part of a theft without necessarily being its original entry point. Teng said the attackers moved through internal systems before exploiting an Ethereum feature on October 29, after Binance had paused withdrawals. The available account does not establish every technical step between the reported internal access and the wallet transaction, making the promised independent review important to a fuller understanding.

How EIP-7702 featured in the theft

The Ethereum feature identified by researchers is EIP-7702, an upgrade from May 2025 that allows ordinary wallets to borrow smart-contract code. According to Gizmodo, that capability was involved in the attack. Blockaid, a blockchain security firm, found that the attacker grouped 50 signed authorizations into one transaction. That mechanism helps explain how the feature was used, but it does not by itself show that the upgrade contains a flaw.

The reported effect was rapid movement of funds even after Binance paused withdrawals. Teng said that on Ethereum one wallet lost about 167,464 ETH and $1.6 billion in Tether. A detailed account of the incident said Binance cleared the delegation nearly four hours later. These figures describe assets in the reported wallet and the timing of that clearance; they should not be mistaken for a complete account of all losses or recovery.

Ethlabs researcher Derek Chiang argued that EIP-7702 is not broken, while acknowledging that it made the theft faster and more efficient. That distinction matters: a feature can provide a useful capability and still affect how an exploit operates when attackers obtain the required authorization. The source does not establish that ordinary users of the upgrade were targeted, nor does it identify a defect in the feature itself.

What the incident says about custody risk

The account raises a separate question about who can sign transactions and how those signing systems are protected. Teng said the attackers reached the system authorizing wallet transactions, while Chiang’s assessment places attention on the way the feature was used rather than on an inherent defect. If an independent review confirms a compromise of signers, the central concern would be exchange custody design, not simply the presence of EIP-7702.

This distinction is relevant to exchange customers because custody systems control how assets held on a platform are authorized to move. The source says users of wallets that support EIP-7702, including MetaMask, need not panic, but that reassurance is Chiang’s view, not a finding from the promised independent review. The account gives no evidence that those wallet users faced the same exposure as Binance’s signing system.

AI tools appear in Teng’s description as part of the attackers’ route through Binance’s internal environment and as tools used in the campaign. Their presence adds context to the reported sequence, but the source does not specify exactly how AI was used or say that AI independently caused the breach. The practical lesson available from this account is limited: internal tools and access pathways featured in the attack narrative and warrant scrutiny.

Recovery steps and unresolved questions

Binance says it has replenished 98% of affected assets, rebuilt its wallet system, replaced devices and cancelled linked credentials. Those measures indicate a response aimed at both restoring affected assets and changing or removing elements associated with the compromised environment. The source does not explain how the replenishment was calculated, identify the remaining affected amount, or provide a timetable for completing all recovery work.

The company also says it is working with law enforcement and industry partners to trace and freeze stolen funds. That work is distinct from replenishing assets: tracing and freezing depend on locating funds and possible intervention, while the reported replenishment describes Binance’s own recovery step. The available account does not say how much, if any, of the stolen cryptocurrency has been frozen or recovered through those joint efforts.

The independent review remains a key unresolved part of the story. Teng has promised one, and its findings could clarify whether attackers compromised a signing system or whether a flaw in EIP-7702 itself contributed. Those possibilities would point to different sources of risk, but neither is established here. Until the review supplies more detail, the account supports caution about conclusions that blame either the Ethereum feature alone or exchange custody alone.

Source: BeInCrypto