Binance-Labeled Wallet Swept Minutes After EIP-7702 Delegation

An Ethereum wallet labeled “Binance 14” by Etherscan transferred about 167,464 $ETH and 1.615 billion $USDT on Oct. 29 after an EIP-7702 delegation installed code on the account. A different address submitted the call that moved the assets.

The same sender later called the delegated wallet again, triggering 780 million $USDC to move from a separate Binance-labeled smart wallet to the same recipient. The onchain records connect the movements but do not establish whether they were authorized, or whether Binance or its customers suffered a loss.

The authorization transaction installed the delegation at 4:20:59 p.m. ET on Oct. 29. At 4:24:23 p.m. ET—three minutes and 24 seconds later—the outside address called the wallet's sweeping function. That transaction recorded 63 ERC-20 transfers alongside the $ETH movement, including the $USDT.

The address submitting the calls also created the delegate contract. It had received about 0.0983 $ETH from a Tornado Cash pool on Oct. 28.

A Separate Wallet, the Same Authority

The $USDC transfer followed at 4:41:23 p.m. ET. Its token source was the contract labeled “Binance: Hot Wallet 34,” not Binance 14 itself. Whale Alert flagged the movement as a transfer from Binance to an unknown wallet.

The link goes beyond a shared recipient. Etherscan's read-only contract interface identifies Binance 14 as that smart wallet's owner. The execution trace shows Binance 14 calling the smart wallet, which then called $USDC to transfer the tokens. Delegated code thus exercised authority over assets held in another account.

Why the Authorization Persists

EIP-7702 lets an ordinary, key-controlled Ethereum wallet execute code stored at another address. Installing that delegation requires a signature from the wallet's key. Its intended functions include batching operations and allowing someone else to pay transaction fees. The delegation persists beyond the transaction that installs it; subsequent callers can trigger whatever actions that code permits without necessarily obtaining a fresh signature from the wallet's key.

“The delegation persists; that code can authorize later transfers without another signature from the wallet,” Phylax Systems founder Odysseus wrote in a thread describing the sequence.

For wallet users, the security boundary is the delegated code, not merely the initial signing prompt. The EIP warns that this code has “unrestricted access to the account” and must be closely audited by wallets. Delegation can be replaced or cleared through a new signed authorization; the protocol specifically supports clearing it by authorizing the zero address.