Anyone can submit the signed authorization to the network, which remains until a replacement or cancellation is recorded onchain.
The feature was meant to let everyday wallets batch payments and have someone else pay their fees. Within weeks of launch, market maker Wintermute found that most EIP-7702 delegations pointed at copy-pasted “sweeper” scripts. Those scripts automatically forward a wallet’s funds to a thief once its key has leaked.
The attacker on Thursday used this very feature to make a Binance wallet holding billions run a sweeper of their own.
Blockchain trail
The attacker’s main wallet, 0x7C86…5CA0, was funded through the mixing service Tornado Cash in small withdrawals starting Wednesday, according to a reconstruction of the network.
On Thursday afternoon UTC, the attacker rehearsed the attack on wallets of their own. At about 16:00 UTC, they deployed a sweeper contract, 0x63e8…6fAe, whose code only lets the attacker’s wallet operate it.
At 20:20:59 UTC, the attacker sent one transaction. It carried 50 authorizations, every one signed by the wallet Etherscan labels “Binance 14” — one of the many wallets associated with Binance — and every one pointing Binance 14 at the sweeper.
Binance 14 keeps a counter, called a nonce, that advances whenever it sends a transaction. Each signed authorization must match the account’s counter when the network processes it.
Leave a Reply