One 29-Byte Signature Drained Billions From Binance. The Private Key Never Left the Building.
On Oct. 29, 2026, at 20:20:59 UTC, a type-4 transaction arrived at an Ethereum address labeled “Binance 14.” It carried 50 EIP-7702 authorizations. Their nonces ran from 18914775 to 18914824, and all pointed to a sweep contract the attacker had deployed that afternoon. Four minutes later, at 20:24:23, the sweep function ran. In one transaction, 167,464 ETH, 1.615 billion USDT, and more than sixty token types left the wallet.