Ethereum on-chain mechanics behind the Binance hack

The Binance hack ranks among the biggest thefts in history. It used one of the largest heists of all time and also took advantage of exploiting Ethereum's wallet delegation system.

The attacker appears to have created a sweeper contract and then sent 50 EIP-7702 authorizations targeting the wallet called Binance 14, sent with signatures from the Binance 14 key.

Because Binance 14 was a hot wallet in active use, the attacker had to send numerous approvals with different nonce values. For the delegation to be accepted, the nonce — a count related to the number of transactions the wallet has processed — in the authorization transaction had to match the wallet's current nonce.

Once approved, the sweeper contract ran as if it were the Binance 14 account and swept the ether and tokens from Binance 14.

Other wallets besides Binance 14 did not depend on this delegation. The delegation was mainly for convenience, since the attacker could sign with the Binance 14 key.

For example, Binance 16 sent its hacked funds on Ethereum through an ordinary transaction, not via delegation.

Other Ethereum Virtual Machine (EVM) chains such as Base, Optimism, Arbitrum, Avalanche, and Polygon also used regular transfers rather than delegation.

Binance eventually removed the delegation from Binance 14, and roughly $2.4 billion worth of funds taken from Binance wallets on Ethereum has been frozen or blacklisted.