Binance14 hot wallet compromised via signing service

An Ethereum transaction used an internal signing service compromise at Binance to attach 50 valid EIP-7702 authorizations to a hot wallet, allowing an attacker to run a sweeper contract for nearly four hours. The authors measured on-chain data showing how one authorization took effect based on the wallet's transaction counter while the remaining unused signatures were retired by routine transactions. Open article →