Binance hack: how the Ethereum wallet delegation worked

Protos has reconstructed how the Binance hack played out on Ethereum. The attacker appears to have deployed a sweeper contract, then sent 50 EIP-7702 authorisations aimed at the address labelled Binance 14. All of them carried the Binance 14 key signature.

A single approval would not have been enough. The wallet was in rapid use, so the attacker had to send many approvals with different nonce values. For the delegation to go through, the nonce in the authorisation transaction had to match the address's current nonce.

After the delegation was approved, the sweeper contract ran as if it were the Binance 14 account. That let it sweep the ether and tokens held at that address.

The delegation was mainly a convenience, since the attacker could already sign with the Binance 14 key. Other wallets did not depend on it. Binance 16 moved its hacked funds on Ethereum through a normal transaction instead.

Chains running the Ethereum Virtual Machine also saw plain transfers rather than this delegation. Protos lists Base, Optimism, Arbitrum, Avalanche and Polygon among them.

Binance eventually removed the delegation from Binance 14. Around $2.4 billion in funds taken from Binance wallets on Ethereum has been frozen or blacklisted.