Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

binancebreach.com

An independent record of the October 2026 Binance hack

All theories

Theory Contradicted

EIP-7702 caused the hack

After Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation, some commenters treated the Ethereum feature as the cause. Ethereum community member VEER said it gave attackers a handy sweep button on Ethereum.

This is a theory, not an established fact. First seen . Updated .

What the evidence does and does not show

EIP-7702 was used on Ethereum for the largest single transaction, about $2.53B according to Elliptic and Hacken. TRM Labs says Binance wallets on the other nine chains sent funds through ordinary signed transfers. Two security executives told Cointelegraph the theft could have been done without EIP-7702. One of them, Blockaid's CEO, works for a company that sells transaction-screening products. Hacken and Blockaid's CEO describe a compromised signing path; in the sources captured as of 2026-11-01, Binance has not published a root cause.

Evidence

Evidence for (3)

Reported

Cointelegraph reported that co-CEO Richard Teng said the attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, and that the delegation did not pass through Binance's normal approval controls.

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Richard Teng, Cointelegraph. Captured . Original

Note: Teng: the delegation did not pass through normal approval controls.

Reported

Cointelegraph quoted Ido Ben-Natan of Blockaid as saying the 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some checks.

“The 7702 upgrade is a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,”

Ido Ben-Natan, Cointelegraph. Captured . Original

Note: Blockaid's CEO: 7702 is a way to do it in one sweep.

Reported

Cointelegraph reported that Ethereum community member VEER said EIP-7702 gave attackers a handy sweep button on Ethereum.

VEER later said the Binance attack appeared broader than a single malicious signature, but that EIP-7702 gave attackers “a handy sweep button on Ethereum.”

Cointelegraph. Captured . Original

Note: A handy sweep button on Ethereum.

Evidence against (4)

Reported

Hacken, quoting investigators, said the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains.

Hacken. Captured . Original

Note: Signing system signed across chains.

Reported

TRM Labs said that on the nine chains other than Ethereum, Binance wallets sent funds to the attacker through ordinary signed transfers.

Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers.

TRM Labs, TRM Labs. Captured . Original

Note: Other chains used ordinary signed transfers.

Reported

Cointelegraph reported that Blockaid CEO Ido Ben-Natan said attackers could have stolen the funds without EIP-7702.

Attackers could have stolen the funds without EIP-7702, Ido Ben-Natan, Blockaid’s co-founder and CEO, told Cointelegraph on Friday.

Ido Ben-Natan, Cointelegraph. Captured . Original

Note: Attackers could have stolen the funds without EIP-7702.

Reported

Cointelegraph reported that Ambire CEO Ivo Georgiev said EIP-7702 made little difference because the hackers already had the ability to authorize transactions.

Ivo Georgiev, co-founder and CEO of Ethereum wallet provider Ambire, said that EIP-7702 made little difference to the attack because the hackers already had the ability to authorize transactions.

Ivo Georgiev, Cointelegraph. Captured . Original

Note: EIP-7702 made little difference.

Context (4)

Reported

Hacken said that at Binance the EIP-7702 delegation stayed in place for 3 hours 46 minutes after the sweep and later deposits were swept again.

At Binance the delegation stayed for 3 hours 46 minutes after the sweep and later deposits were swept again

Hacken. Captured . Original

Note: The delegation stayed in place for 3 hours 46 minutes.

Reported

Blockaid said the EIP-7702 delegation was visible on-chain for three minutes and 24 seconds before the sweep.

The delegation itself was visible onchain for three minutes and 24 seconds before the sweep

blockaid.io. Captured . Original

Note: Delegation visible before the sweep.

Reported

Blockaid said its transaction security engine classified the delegation transaction as malicious because an EOA was being upgraded through EIP-7702 to an untrusted address.

Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.

blockaid.io. Captured . Original

Note: Blockaid says its engine flagged the delegation.

Reported

Blockaid, which sells a product called Cosigner that rejects malicious transactions before signing, wrote its analysis of the Binance incident.

Blockaid Cosigner is an independent signing layer that sits on a wallet and utilizes signals from our exploit detection engine to reject malicious transactions.

blockaid.io. Captured . Original

Note: Blockaid sells a product that screens transactions before signing.