Introduction

In October 2024, Binance suffered a $6.36 billion drain across ten blockchains, the largest single heist in crypto history. The attack exploited how hot wallets sign transactions, raising urgent questions about exchange security.

What Happened

On the evening of October 29, a Binance hot wallet on Tron sent 612.7 million USDT and 46.4 million TRX to an uncontrolled address. Within minutes, Ethereum, Bitcoin, Solana, Optimism, and five other chains were hit. An attacker moved roughly $6.36 billion out of Binance wallets in about 20 minutes, using 50 sequential EIP-7702 authorizations signed by the exchange’s hot wallet label. A sweeper contract then drained funds repeatedly over hours.

  • Attack began on Tron, then spread to nine additional chains.
  • 50 consecutive EIP-7702 signatures bypassed normal approval gates.
  • Funds were routed through a contract that swept new deposits every few minutes.

Why This Matters

The breach exposed a fundamental truth: blockchains accept any transaction with a valid signature, regardless of who produced it. While Tether and Circle froze over $1.8 billion in stablecoins, Bitcoin and Ethereum recoveries depend on law enforcement or exchange policy. The attack’s speed and cross-chain scope show how a single compromised signing path can erase billions in minutes.

Key Takeaways

Exchange hot wallets should never trust internal service containers for signing authority. Each chain and wallet tier needs its own signer, with per-hour outflow limits and automatic halts for unfamiliar addresses. EIP-7702 delegations must require explicit human approval, and bulk authorizations should trigger immediate alerts.

  • Dedicated, locked-down devices for all production access.
  • Hardware-bound keys isolated from developer laptops.
  • Per-chain signers with capped withdrawal rates.
  • Real-time alerts for bulk EIP-7702 authorizations.

Conclusion

Binance has pledged to cover all losses from its own reserves and is working toward restoring withdrawals after security checks and a proof-of-reserves report. For users, the hack is a reminder to treat exchange holdings as temporary and verify proof-of-reserves when available. The industry’s next wave of custody improvements will likely hinge on whether exchanges separate signing paths, enforce human approval for delegation, and isolate hot-wallet keys from developer environments.