Binance Hack Data Shows $3.66B of the $6.3B Theft Occurred Without Ethereum’s EIP-7702

The role of Ethereum’s EIP-7702 authorization standard in the theft from Binance’s main Ethereum wallet appears to have been significant, but it does not account for the full amount identified in the incident. While transactions using the feature helped facilitate a major sweep of funds, blockchain analysis indicates that approximately $3.66 billion moved through other mechanisms.

That distinction has become central to the discussion surrounding the reported $6.3 billion theft. Early explanations focused heavily on EIP-7702, a relatively new Ethereum feature that allows an externally owned account, or EOA, to temporarily operate with smart-contract functionality. The technology can make wallets more flexible by enabling features such as transaction batching, sponsored fees and more advanced permission systems. It can also increase the consequences of a compromised authorization.

In Binance’s case, EIP-7702 reportedly enabled the movement of assets from the exchange’s primary Ethereum wallet. The feature may have provided the mechanism for carrying out a coordinated sweep, allowing funds to be transferred in a way that differed from a conventional wallet transaction. That connection led some observers to describe the protocol upgrade as the cause of the breach.

However, identifying a tool used in part of an attack is not the same as explaining the entire loss. The available analysis separates the funds moved with the help of EIP-7702 from those transferred through other routes. Of the $6.3 billion cited in reports about the incident, roughly $3.66 billion was taken without relying on the standard, including transfers described as ordinary transactions.

That breakdown complicates attempts to assign responsibility to a single Ethereum feature. EIP-7702 may have played an important role in the movement of assets from the affected wallet, but the figures indicate that the incident involved a broader set of transactions and access pathways. The technology alone therefore cannot explain the scale of the reported theft.

The distinction also matters because EIP-7702 is not itself a custody system or an automatic transfer mechanism. It is a protocol-level capability that changes what a conventional Ethereum account can do when an authorized delegation is attached to it. Whether the feature becomes useful to an attacker depends on how wallet permissions are managed, what signatures are obtained and whether a malicious party can gain control of the relevant account or authorization data.

For exchanges and other large custodians, those questions are especially important. A major Ethereum wallet can hold a wide range of assets and may be connected to operational processes involving hot-wallet access, automated transfers and signing infrastructure. A weakness in any of those layers could allow funds to move, regardless of whether a transaction uses EIP-7702.

The incident has consequently renewed attention on the difference between protocol risk and implementation risk. A new Ethereum standard can introduce unfamiliar authorization flows and create additional safeguards that companies must understand. But a breach involving an account that has used the standard does not automatically demonstrate that the standard caused the compromise. Investigators still need to determine how the attacker obtained access, which permissions were abused and how each group of transactions was authorized.

The reported movement of $3.66 billion through routes other than EIP-7702 is particularly relevant to that investigation. It suggests that the wallet’s exposure extended beyond the feature that initially attracted public scrutiny. Ordinary Ethereum transactions can move assets when an attacker controls the account’s signing authority, and they can also be used alongside more specialized techniques to distribute funds rapidly across multiple addresses.

For users, the episode illustrates why transaction visibility and authorization controls remain essential even as Ethereum wallets become more capable. EIP-7702 can support useful features, but those capabilities also make it more important to monitor delegated permissions, verify signing requests and limit the amount of capital held in accounts with broad operational access.

The event may also influence how exchanges explain security incidents. Public attention often gravitates toward the newest protocol feature involved in a breach, particularly when that feature is not yet widely understood. A complete account, however, must distinguish between the transaction format, the authorization that allowed the transfer and the security failure that gave an attacker access in the first place.

Based on the reported figures, EIP-7702 was connected to the sweep from Binance’s main Ethereum wallet, but it was not the explanation for the entire $6.3 billion loss. With about $3.66 billion moving through other routes, the incident points to a wider compromise rather than a single-feature failure. Further conclusions will depend on a transaction-by-transaction reconstruction of the theft and a clearer account of how the wallet’s signing authority was obtained.