A bytecode reconstruction of the sweeper contract used on Binance’s hot wallet has revealed technical details behind the asset drain that hit the crypto exchange. Technical analysis from CyberSatoshi shows the attacker deliberately left exactly 1 ETH in the target wallet. This step was taken so that Binance’s automated transaction queue would not encounter out-of-gas errors, preventing internal monitoring alarms from being triggered.
The findings drew the attention of Cardano founder Charles Hoskinson. Sharing CyberSatoshi’s reconstruction publicly, Hoskinson warned of “extremely dangerous code” operating behind the looting. What makes this method dangerous is not merely its speed, but how the attacker engineered the code to make the exchange’s systems believe everything was functioning normally.
Avoiding Gas Errors and Blacklists
The contract deployed by the attacker operated with high resilience against transaction disruptions. The attacker embedded token-processing loops based on low-level calls. This mechanism ensured asset transfers continued smoothly, even if certain assets failed to transfer or had been blacklisted. The failure of one token type did not revert the withdrawal of other assets in the same batch.
Similar precision was applied when the attacker targeted funds outside the primary wallet. Through a custom execution function, the compromised Binance 14 address was used to call an external vault holding 823 million USDC. The vault contract processed the transfer instruction because the system recognized the Binance 14 address as an authorized controller.
The EIP-7702 Delegation Fast Track
Beyond designing disruption-resistant contract execution, the hacker leveraged Ethereum’s EIP-7702 delegation architecture. This feature allows standard externally owned accounts (EOAs) to execute smart contract logic. Through this delegation, multiple asset transfers were compressed into a rapid sequence of operations, slashing the intervention window for the exchange’s security team.
To maximize momentum, the attacker submitted 50 pre-signed authorizations with sequential nonces. The attack was launched precisely as Binance’s internal transaction counter became active, allowing dozens of withdrawal instructions to be processed before the system could respond.
Private Keys Already Compromised
Hoskinson’s warning about the dangers of this code also directed the spotlight toward the true root cause. Although EIP-7702 delegation allows regular accounts to run smart contract logic, Ethereum’s protocol specifications still require a valid cryptographic signature from the victim’s account. Without an authorized signature, delegation instructions cannot be executed by the network.
The requirement for valid signatures indicates that the attacker had already gained control of raw private keys or possessed unrestricted signing access within Binance’s infrastructure before the delegation was executed. For industry observers and market participants, the reconstruction confirms that no matter how sophisticated a smart contract is at evading transaction alarms, the most fatal vulnerability still occurs when private key control falls into external hands.
Reported by crypto.news.
Read also: How Crypto Staking Works and Its Risks
Previously: Binance Hot Wallet Drained for Up to $5.8 Billion via EIP-7702 - Stablecoin Issuers Freeze $2.5 Billion
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
