One 29-Byte Signature Drained Billions From Binance. The Private Key Never Left the Building.

On Oct. 29, 2026, at 20:20:59 UTC, a type-4 transaction arrived at an Ethereum address labeled “Binance 14.” It carried 50 EIP-7702 authorizations. Their nonces ran from 18914775 to 18914824, and all pointed to a sweep contract the attacker had deployed that afternoon. Four minutes later, at 20:24:23, the sweep function ran. In one transaction, 167,464 ETH, 1.615 billion USDT, and more than sixty token types left the wallet.

Binance puts affected assets at about $6.3 billion, with roughly $3 billion frozen. On-chain analysis firms estimate outflows between $5.3 billion and $5.9 billion, depending on method. Every count exceeds the roughly $1.5 billion stolen from Bybit in 2025. It is the largest recorded theft in the industry.

The figure records the outcome. The mechanism was narrower. The attacker likely never held the private key to Binance 14. He sent an authorization into Binance’s signing pipeline. An automated system signed away the wallet’s execution rights because it could not recognize what it was signing.

The loss continued after 20:24

The delegation stayed active. At 20:41, the attacker used the still-delegated Binance 14 to operate a Circle smart account under its control. He moved $780 million USDC, then another $43 million. At 21:44, the sweep function ran again. It drained about $200 million USDT and a dozen token types deposited into Binance 14 after the first sweep. Until around 22:00 UTC, the delegation remained valid. Any asset sent to that address could be moved without another signature.

That detail matters more than the headline figure. A traditional hot-wallet breach follows a simple model. The balance is drained, the stop-loss runs, and the loss is bounded by what sat in the wallet at the moment of attack. A 7702 delegation changes the boundary. The attacker gained the current balance, future inflows, and assets in other accounts the wallet controlled. The risk moved from an instant balance loss to a continuous transfer of execution rights.

Binance’s preliminary investigation points to a compromised laptop belonging to a DevOps engineer. The attacker used it to enter a service container and submit unauthorized transactions. No evidence of private key leakage has surfaced. The official language remains cautious. The final conclusion will come in a full post-mortem.

Why 29 bytes bypassed the strategy engine

Ethereum’s Pectra upgrade introduced EIP-7702 in May 2025. It lets an externally owned account sign an authorization that designates a contract address. When the account is later called, it executes that contract’s code with full authority over all assets in the account.

The signed text of a 7702 authorization is about 29 bytes: a magic byte, chain ID, the delegated contract address, and a nonce. No recipient address. No amount. No calldata.

Institutional wallets usually place a policy engine in front of the signing service. The rules check transaction fields. Is the recipient on a whitelist? Does the single transaction exceed a limit? Has the 24-hour cumulative volume breached a threshold? Is the called contract method permitted? These rules check who receives money and how much leaves.

A 7702 authorization has none of those fields. The policy engine has nothing to inspect. If the signing service receives a 32-byte hash and signs it, it cannot tell whether the hash comes from an ordinary transfer or from an authorization that hands over account execution rights. The delegation remains valid until the account signs another authorization to override it.

The nonce window shows the method. The attacker submitted 50 authorizations because each one only takes effect if its nonce exactly matches the account’s current nonce. Binance 14 is one of the busiest Ethereum hot wallets. In the three minutes before the attack, it sent 33 normal withdrawal transactions, about one every six seconds. The attacker could not predict the nonce when the signature would return, so he signed a range. The 16th authorization hit. The other 49 expired unused.

In his rehearsal, the attacker used a window of two or three nonces. Against Binance, he used 50. The gap suggests he did not hold the private key. He submitted the content to Binance’s signing pipeline and waited for the signature. He could not control when or how fast it returned, so he widened the window.

Another detail: ten other Binance hot wallets on Optimism, Arbitrum, and Avalanche were drained during the same period. All used ordinary transfers. None used 7702. Only Binance 14, the main Ethereum wallet, was delegated. One explanation is that sweeping sixty-plus token types in one go was simpler. Another is that Binance 14’s policy would have rejected transfers to new addresses but had no rule for authorization signatures. On-chain data cannot separate the two. Binance’s post-mortem should answer it.

Bybit was a different failure

The Bybit breach in 2025 involved a tampered Safe multisig front end. Signers saw one thing and signed another. The lesson was that the interface a signer sees cannot be trusted. That was still a scenario with a human to deceive and an interface to manipulate.

The Binance incident sits lower in the stack. The signing system did not parse the type of object it signed. No one was tricked. No interface was altered. An automated pipeline followed its normal process and signed something it could not classify.

Multiple firms attribute both incidents to the North Korean TraderTraitor group. TRM Labs gives a high-confidence judgment. The preparation shows an opponent that studied EIP-7702 more thoroughly than most exchange security teams. It included two days of funding through Tornado Cash, several small-value rehearsals on the day of the attack, a nonce-window design built for a busy wallet, and an immediate swap of USDT into ETH to evade freezing.

The industry lesson is not “tighten private key management.” The key was not stolen. The interface was not tampered with. The signer was not socially engineered. The failure point is that the dimensions a signing policy checks and the semantic dimensions of the object being signed no longer occupy the same plane. The policy engine asks to whom and how much. A 7702 authorization answers which contract receives this account’s execution rights. The latter has no amount, no recipient, and no calldata. The traditional rule set has nothing to say.

Proof of reserves moves slower than confidence

CoinDesk compared Binance’s Oct. 1 proof-of-reserves snapshot and found that Binance 14 is a reserve-listed wallet. At that time it held about $1.26 billion USDT and 89,000 ETH. Binance’s ETH reserve ratio was exactly 100%. After roughly 204,500 ETH were stolen, that ratio would fall to about 94% until the exchange replenishes the shortfall. The Nov. 1 snapshot will show whether it has been topped up.

The ratio matters less than the mismatch between the low-frequency, after-the-fact, aggregated nature of proof of reserves and the speed at which a risk event travels. The attack happened on Oct. 29. The Nov. 1 snapshot is the first public update that can reflect whether the gap was filled. For more than 72 hours, the market faces an information vacuum. Users know billions may have flowed out. They do not know whether segregated user assets were used to fill the hole or whether a cold-wallet transfer is underway.

For an exchange with large daily withdrawals, confidence shocks travel faster than reserve snapshots update. Bank-run pressure does not come from insolvency. It comes from rational precautionary withdrawals by users who cannot distinguish “insolvent” from “temporarily illiquid.” Whether Binance can complete a cold-wallet transfer and publish verifiable on-chain proof of replenishment before the first business day is a more important confidence stabilizer than the final stolen amount.

What to fix

If the industry takes away only “guard private keys more tightly,” the next attack will use another signature type with no inspectable fields and bypass the same policy engine. The repair list is concrete.

First, signing policy must move from field-checking to type-checking. The policy engine needs to recognize EIP-7702 authorizations, EIP-2612 permits, and other authorization signatures that carry no amount and no recipient. It should apply separate rules to them. For example: prohibit automated pipelines from signing 7702 authorizations; require manual review plus a time lock; whitelist and audit the delegated contract; trigger a circuit breaker when an account submits many consecutive nonce authorizations in a short window.

Second, map the permission radius of each hot wallet. A hot wallet may control assets in other contract accounts through smart-account mechanics. A 7702 delegation means every asset within that permission radius is exposed. Exchanges need a permission topology for hot wallets, not just balance monitoring. They need to know which other accounts are affected if this address falls.

Third, monitor behavior sequences, not just single-transaction thresholds. The attacker spent two days preparing funds through Tornado Cash. He ran two full rehearsal sweeps with small amounts on the day of the attack, deployed the final contract in the afternoon, and executed at night. The preparation can be completed without triggering a large-value alert. Defenders need to watch for the sudden appearance of 7702 authorizations, repeated test calls to the same deployer’s contract, and the pattern of small rehearsal followed by large execution.

Fourth, pair proof of reserves with real-time verifiable replenishment proof. Low-frequency snapshots cannot cover high-frequency risk windows. After an incident, an exchange should publish on-chain evidence of cold-wallet transfers, the address list of frozen funds, and verifiable balances as quickly as possible. That shortens the information vacuum.

The number to watch

The 94% ETH reserve ratio is the only figure the market can verify until Binance publishes its next snapshot. The Nov. 1 proof-of-reserves update will show whether the gap has been closed. If it has, the story becomes a costly lesson about signing semantics. If it has not, the story becomes something else, and the $6.3 billion headline will be the least important number in it.