Security firm Blockaid says an attacker used Ethereum’s EIP-7702 wallet feature to connect a Binance account to code capable of draining its assets. Its findings offer a closer look at the transfers flagged during the exchange’s October 29 security incident.
Key to the analysis are the wallet permissions. According to Blockaid, after a total of 50 different variations were submitted in a single transaction by the attacker, one permission kicked in, and the dangerous code got a route to grab money out of the account.
How the permission took effect
Through EIP-7702, an Ethereum account can delegate the execution of functions to a smart contract. Permissions are granted to the smart contract code, which determines permitted operations.
Blockaid noted that the said account had delegated to another contract with functions to withdraw tokens and Ether, with a specific “operator” address being authorized to access these operations.
Basically, the arrangement gave that operator a way to collect assets from the affected wallet, and even new funds that arrive in the account are not safe.
Fifty variations, one accepted
Blockaid also followed up and explained that the attacker apparently lacked the wallet’s current account counter.
That counter, called a nonce, helps to determine whether an authorization can be accepted. An actively used wallet’s counter changes as transactions are processed.
According to Blockaid, the attacker submitted 50 signed authorizations covering consecutive counter values. One matched the account’s counter when the transaction was included on the blockchain.
The firm summarized the result:
Only 1 of 50 was a hit.
Binance’s investigation continues
In its security update on October 30, Binance says the estimate of the incident’s total impact is about $6.3 billion. It said about $3 billion in affected assets had been frozen.
The exchange’s initial investigation pointed to a potentially compromised engineer’s laptop that allowed unauthorized withdrawals. Binance has said it would cover losses.
Binance has promised a technical report after completing its investigation.
Final Summary
- Blockaid says an EIP-7702 authorization connected a Binance wallet to asset-draining code.
- It has not been mentioned how the attacker was able to get the required signatures.