At 20:16 UTC on 29 October, the first unusual draws began on Base and Optimism. Eight minutes later, a single transaction on Ethereum sent by address 0x7C86…5CA0 pulled 64 different tokens — stablecoins, wrapped assets, governance tokens, LSTs — out of Binance Hot Wallet and into a receiving address, 0x5227…2f8c. The value moved in that one transaction was $2.54 billion.
Within twenty minutes, Binance's hot wallets on Bitcoin, Tron, Solana, Arbitrum, Avalanche, Base, Optimism and the Ethereum beacon chain had also been emptied. Binance's Bitcoin hot wallet sent 18,270 BTC ($1.44 billion) to a new address that then split it into 1,000-BTC chunks across nineteen addresses, none of which have moved since. Binance's Tron hot wallet sent 612.7 million USDT and 46.4 million TRX to a single Tron address. 970,537 SOL ($94 million) went to one Solana address and sat there untouched.
By the time the draws stopped, $5.97 billion had left Binance across nine chains. Thirty-six attacker-controlled wallets held the proceeds.
The single-transaction drain was possible because of EIP-7702, which went live on Ethereum in 2025. EIP-7702 lets an externally owned account — a normal private-key wallet — delegate its execution to a smart contract. The wallet keeps its address and its balances, but any transaction sent from it now runs the contract's code. For a hot wallet, that means a contract controlled by someone else can move every token the wallet holds in a single call.
The setup took about twenty-eight hours. On 28 October, the signer address 0x7C86…5CA0 received 0.3 ETH from Tornado Cash in three 0.1 ETH withdrawals. At roughly 02:30 UTC on 29 October, that signer deployed a test contract. At about 16:00 UTC, it deployed the real one: 0x63e8…6fae. Four hours later, at 20:24 UTC, Binance Hot Wallet 14 was EIP-7702 delegated to that contract, and the same signer sent the transaction that emptied it.
The delegation itself is the open question. For a 7702 delegation to take effect, the wallet's own private key must sign an authorization message. That signature was produced somehow, and it was produced before 20:24 UTC on 29 October. Binance has not said how. Insider access, a compromised signing device, and a key-management supply-chain compromise are the three explanations consistent with the onchain record.
Total attacker gas budget for an operation that drained $5.97 billion: 0.3 ETH, roughly $1,000 at the time.
Tether and Circle both act as centralized issuers of their stablecoins, which means they can freeze any address holding USDT or USDC. They used that authority on this incident faster than on any prior one.
By roughly 21:10 UTC — about fifty minutes after the main drain — Tether had frozen 971 million USDT and Circle had frozen 823 million USDC in the receiving address 0x5227. Tether then froze a further 312.7 million and 66 million USDT in the two Tron addresses receiving Binance's TRX hot wallet funds. When Binance Hot Wallet 14 sent an additional 200.4 million USDT at 21:44 — the wallet was still delegated to the attacker's contract, so the funds were swept the instant they landed — Tether froze that too.
The total frozen stands at $2.58 billion. That is 43 percent of the drained amount, and it is close to the ceiling of what issuer action can reach. Everything the attacker had already swapped out of stablecoins — the Bitcoin, the ETH, the TRX, the SOL, the wBETH — is beyond Tether and Circle's authority. Six attacker wallets carry freezes.
As of 23:48 UTC on 29 October, the $5.97 billion splits three ways. Issuer freezes account for $2.58 billion. The attacker has swapped $717 million of USDT into ETH and TRX on Uniswap, 1inch and SUN.io, locking those gains beyond issuer reach. The remaining $2.67 billion is still liquid in attacker wallets and has not moved.
The swap cadence is tight and tells its own story. Between 20:34 and 20:49 UTC — in the window before the first Tether action — 325 million USDT was swapped to roughly 122,000 ETH on Ethereum. On Tron, 234 million USDT was swapped to 639 million TRX on SUN.io over the following half hour. The attacker was selling stablecoins into non-freezable assets as fast as DEX liquidity allowed, and stopped once Tether's freezes made the remaining USDT unusable.
One position deserves separate mention. An attacker-controlled Aave V3 account, 0x8d53…639A, has deposited 60 million USDT as collateral and borrowed 19,763 WETH. The health factor is 1.042. If ETH rises about 4.2 percent, Aave liquidates the position and the 60 million USDT collateral, now frozen by Tether, passes to Aave's liquidators. That is the only non-issuer clawback mechanism that currently works against this attacker, and it depends on ETH moving on the news.
The Bitcoin and Solana balances have not been touched since the initial transfers. The BTC sits in nineteen fresh addresses in 1,000-BTC lots, a pattern consistent with pre-mixer staging. The SOL sits in a single address with no onward activity, which is unusual — Solana exits typically take hours, not days.
Exchange hot wallet compromises are not new. What is new is the mechanism. Prior drains at this scale have required the attacker to issue separate transactions for each asset, which creates a window — minutes at least, often longer — in which an exchange's monitoring can detect the first outflows and move the remaining assets. The DMM Bitcoin incident in 2024 took that shape. The Bybit incident in 2025 took that shape.
EIP-7702 closes that window. One signed delegation plus one transaction empties the wallet, and the only onchain signal before the drain is the delegation itself. The authorization tuple carrying that delegation is submitted by a sponsor and lands in the mempool a few seconds ahead of the drain transaction, or in the same block. By the time an exchange's monitoring sees it, the window to react is already closed.
The lesson for exchange operations is that hot-wallet monitoring now needs to treat any 7702 authorization on a custody address as a critical alert, not an informational event. The lesson for compliance teams on the receiving end is that EIP-7702 drains will concentrate the attacker's exposure into a single receiving address holding dozens of tokens at once, which makes early labeling and freeze requests more effective per hour of analyst time than in prior incidents. In this case, Tether and Circle appear to have moved on exactly that basis.
Merkle Science is tracking the attacker clusters across all nine affected chains and will update this post as the funds move.
