© 2026 AnChain.AI. All Rights Reserved | Privacy Policy
AnChain.AI examines the reported multibillion-dollar Binance hack, explaining Ethereum outflows, EIP-7702 abuse, attacker rehearsals, and on-chain evidence. Written within hours of the incident, this article presents preliminary figures and findings that may change as the investigation develops.
Disclaimer: For informational purposes only; this article does not constitute financial or legal advice. Consult qualified blockchain forensics experts and legal counsel befor taking legal action.
Just a few hours ago on October 29, 2026, Binance-linked Ethereum wallets sent billions of dollars to a new collection address. Most recent stats showing approximately $3.52 billion in inflows between 20:24 and 21:04 UTC:.
Binance Exploiter Collection address: 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c, as visualized on the AnChain.AI Insights AI Agent platform.
These figures describe cumulative inflows during that window, not the wallet's current balance or a confirmed final net loss. Binance said it was investigating and that user funds were safe.
EIP-7702 delegation was the key tactic used against Binance 14. It made the exchange wallet execute an attacker-deployed sweeper. How the attacker obtained the required authorization signatures remains unresolved; the transaction evidence alone does not distinguish private-key theft from signing-system compromise.
An ordinary Ethereum wallet, called an externally owned account or EOA, is controlled by a signing key. EIP-7702 lets it run smart-contract code stored at another address while keeping its own address and balances. Legitimate uses include combining multiple actions and allowing another account to pay gas.
Think of attaching an automation rulebook to a bank account. Trusted code can enforce payment limits; malicious code can empty the account.
A Type-4 transaction (0x04) carries signed authorizations specifying the chain, delegate address and account nonce—a sequence counter. Ethereum checks the signature and nonce, then records a delegation pointer: 0xef0100 followed by the delegate address. Calls to the wallet now execute that code using the wallet’s assets and permissions. Another account can submit the transaction and pay gas, but the wallet’s valid authorization is still required.
In the Binance incident, the attacker supplied 50 signed authorizations with different nonces. This range appears designed to accommodate Binance 14’s changing counter as it processed transactions. One authorization matched and installed the malicious delegation. A later call triggered the sweeper to transfer the wallet’s ETH and tokens. See this 50 authorization list:
Delegated code can transfer the wallet’s own tokens without a separate token allowance. The delegation also persists until replaced or cleared, potentially exposing new deposits to further sweeps.
This was not private-key guessing: valid signatures were already available. How the attacker obtained them remains unresolved.
The incident illustrates the mechanism in two transactions.
At 20:20:59 UTC, the operator installed the delegation on Binance 14, 0x28c6c06298d514db089934071355e5743bf21d60.
Authorization transaction: 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b.
The published signature reconstruction identifies 50 Binance 14 authorizations pointing to 0x63e842b054bd624a465454d533c33f573e9c6fae. Their nonces span 18,914,775–18,914,824; the reported matching nonce was 18,914,809. A nonce is an account's sequence counter. The signed range appears designed to cover uncertainty about that counter in a busy wallet; it did not bypass signature verification.
At 20:24:23 UTC, just 3 minutes 24 seconds later, the operator called the delegated wallet.
Sweep transaction: 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3.
The indexed execution record shows approximately 167,464.25 ETH and 1,615,409,498.97 USDT moving to the collection address, alongside other tokens. The outer transaction attached zero ETH: the sweeper moved ETH already inside Binance 14. Investigators must inspect execution traces for native ETH and Transfer events for tokens.
Per drk.vc news, the reported transaction reconstruction places rehearsals on attacker-controlled test wallets hours before the drain. The earliest used an earlier contract version; tests of the final sweeper followed later. All times below are UTC on October 29, 2026.
13:51 — Earlier-contract rehearsal. Reported transaction 0xec5af21dc34fc8a3ac131f694aa0df5b27c0525ea3a71d97daa7e597abcb21d9 delegated test account 0x9C29BA2DE4b2d6c3630685650663cFE7B70dbB6B using three candidate authorization nonces: 0, 1 and 2. This was approximately 6½ hours before the main sweep.
15:59:11 — Final sweeper deployed. Reported deployment transaction 0x97408e75… created the contract later delegated by Binance 14.
16:25–16:47 — Final-sweeper rehearsal. Reported delegation transaction 0x7c5206cb… targeted test account 0x43AE…04BD; additional calls exercised the sweep. These tests occurred roughly four hours before the drain.
20:20:59 — Binance 14 delegated: authorization transaction.
20:24:23 — Main asset sweep: sweep transaction.
20:41:23 — Another 780 million USDC moved from Hot Wallet 34: transaction 0xdc102dd89dded5a83f1008906883ffb7c81ff3b7d7965d8c7277d170b5e17481. The reported call path passed through delegated Binance 14, which Hot Wallet 34 already trusted as an operator. Delegation therefore exposed permissions beyond assets held directly by the EOA.
The rehearsal identifiers above are abbreviated in the published reconstruction; complete hashes were unavailable for independent matching. They should be treated as reported leads. The full delegation, sweep and USDC transaction links support follow-up examination; the transactions were not independently replayed here.
For investigators, preserve the authorization list, recovered authority, historical account code, call traces and token logs. For wallet operators, monitor unexpected delegation and review every contract that trusts an affected account.
AnChain.AI Insights is free for Binance customers. Ask questions in plain language, trace wallet activity and follow the funds: anchain.ai/insights.
© 2026 AnChain.AI. All Rights Reserved | Privacy Policy