Incident-Analysis

Binance Ethereum Wallet Incident and EIP-7702 Nonce-Range Spray

• whackur
• Blockchain , Security
• October 30, 2026

Early on October 30, 2026 in Korea, the Ethereum account labeled Binance 14 by Etherscan was configured with an EIP-7702 delegation. Three minutes and 24 seconds later, an external executor called the account, and ETH plus multiple ERC-20 tokens moved to the attacker’s recipient address. The raw delegation transaction contains 50 valid signatures that recover to the victim account. The observed path is consistent with account authority takeover using valid delegation signatures. The available evidence does not establish a signature-verification bypass or a break of ECDSA. Delegation transaction, main sweep