Security firm Blockaid reports that an attacker exploited Ethereum’s EIP-7702 wallet feature to link a Binance account to code that could deplete its assets. The findings provide an in-depth examination of the transfers identified during the security incident that occurred on October 29 at the exchange. Central to the analysis are the wallet permissions. Blockaid reports that following the submission of 50 distinct variations in a single transaction by the attacker, a specific permission was activated, allowing the malicious code to access funds from the account.
Through EIP-7702, an Ethereum account can delegate the execution of functions to a smart contract. Permissions are allocated to the smart contract code, which delineates the authorised operations. Blockaid observed that the aforementioned account had assigned authority to another contract equipped with functions to withdraw tokens and Ether, with a designated “operator” address granted permission to execute these operations. Essentially, the arrangement provided the operator with a mechanism to gather assets from the impacted wallet, and even new funds entering the account remain at risk.
Blockaid also followed up and explained that the attacker apparently lacked the wallet’s current account counter. The counter, referred to as a nonce, serves to ascertain the acceptability of an authorisation. An actively utilised wallet’s counter fluctuates as transactions are executed. According to Blockaid, the assailant presented 50 signed authorisations that encompassed consecutive counter values. One aligned with the account’s counter when the transaction was incorporated into the blockchain.
In its security update on October 30, Binance reported that the estimated total impact of the incident is approximately $6.3 billion. It was reported that approximately $3 billion in affected assets had been frozen. The exchange’s preliminary inquiry indicated that a possibly compromised engineer’s laptop facilitated unauthorised withdrawals. Binance has announced its intention to cover losses. Binance has committed to releasing a technical report following the conclusion of its investigation.
