Blockaid Reveals How Hacker Took Control of Binance Wallet: One of 50 EIP-7702 Authorizations Succeeded According to analysis by blockchain security firm Blockaid, the attacker used Ethereum’s EIP-7702 authorization mechanism to attack Binance’s Binance 14 hot wallet.
Because the attacker could not determine the hot wallet’s live nonce, and EIP-7702 authorizations must match the account’s nonce at the time of transaction execution, the attacker submitted 50 authorizations with different nonces (18914775 to 18914824) in a single Type-4 transaction
Only one matched successfully, allowing the malicious delegation to take effect. The successful authorization delegated the hot wallet’s account code to an unverified malicious asset-transfer contract. The contract allows only the address designated by the attacker to execute the sweep() function, which can transfer ETH and ERC-20 tokens from the wallet while retaining 1 ETH for gas fees.
Subsequent incoming assets may also be at risk of being transferred. — link