TL;DR

• Binance hack shows an attacker reportedly used Ethereum’s EIP-7702 authorization feature to drain approximately $2.5 billion from Binance’s Ethereum hot wallet.
• The attacker gained the ability to move funds without repeatedly requesting individual transaction approvals. The incident forms part of a wider Binance security breach estimated at $6.3 billion.
• Binance suffered one of the largest cryptocurrency security incidents on record after an attacker exploited an Ethereum authorization mechanism to drain approximately $2.5 billion from one of its hot wallets.

The attack targeted a wallet identified as Binance 14 and involved Ethereum’s EIP-7702 functionality, which allows externally owned accounts to temporarily execute smart contract code without migrating to a separate smart contract wallet.

According to blockchain analysis, the attacker used a malicious authorization to give a smart contract control over the wallet’s transaction execution. This effectively transformed the exchange’s wallet into an automated fund-draining mechanism.

The incident is part of a broader security breach that affected multiple Binance wallets across several blockchain networks, with estimated losses reaching approximately $6.3 billion.

How EIP-7702 Enabled the Binance Wallet Drain

EIP-7702 was introduced as part of Ethereum’s Pectra upgrade to improve wallet functionality and support features such as transaction batching and account abstraction.

However, the same flexibility can introduce serious security risks when authorization requests are not properly verified.

In Binance’s case, blockchain security analysts reported that the attacker prepared 50 EIP-7702 authorization requests targeting Binance 14. Each authorization was associated with a specific transaction nonce, meaning only one would match the wallet’s current transaction sequence. One of those authorizations was accepted, allowing the wallet to execute code from a malicious sweeper contract.

The binance hack shows the attacker subsequently called the contract to transfer assets out of the wallet. The first major transaction moved approximately 167,464 ETH, alongside roughly $1.6 billion in USDT and dozens of other tokens.

The combined value of the assets transferred was approximately $2.5 billion.

According to Bitquery’s investigation, the attacker continued using the delegated functionality to execute additional transfers over the following hours.

Binance’s Broader Security Breach Reaches $6.3 Billion

The Ethereum wallet incident was only one component of a much larger attack.

Binance estimated that approximately $6.3 billion in cryptocurrency was affected across multiple blockchain networks. Its preliminary investigation pointed to a potentially compromised DevOps engineer’s laptop, which may have provided access to internal infrastructure and enabled unauthorized withdrawal requests.

The exchange said it had found no evidence that wallet private keys were leaked.

Meanwhile, blockchain security companies identified unusual authorization activity and suspicious transaction patterns across the affected wallets.

Binance also coordinated with stablecoin issuers and blockchain partners to freeze portions of the stolen assets. Approximately $3 billion had reportedly been frozen, although the recovery process remained ongoing.

Bitcoinist previously reported on the massive Binance hack and the estimated $6.3 billion impact.

Ethereum’s Wallet Flexibility Raises New Security Questions

The incident highlights an important distinction between introducing more functionality into cryptocurrency wallets and maintaining secure authorization processes.

EIP-7702 offers legitimate benefits for Ethereum users, including more flexible transaction execution. However, delegating execution to external code also means that malicious permissions can create significant exposure if signing systems fail to identify suspicious requests.

The Binance incident does not establish that EIP-7702 itself contains a vulnerability. Instead, it demonstrates how a legitimate protocol feature can become part of an attack when authorization controls are compromised.

For the broader cryptocurrency industry, the incident adds urgency to discussions about transaction verification, wallet permissions, and operational security.

MSCI’s November 11 announcement could remove Strategy from global equity indexes. The decision puts a source of demand for MSTR shares under scrutiny as the company continues using share sales to finance Bitcoin purchases. Strategy’s next index test arrives on…

Polymarket’s October 29 breach reached traders through a compromised website supplier. Researchers found code that tried to use logged-in accounts to sell positions and move assets, exposing the trust traders place in the screen they use to manage their money.…

Arkham has attributed almost 3% of PEPE’s supply to wallets linked to Justin Sun. The estimate combines known and predicted addresses, while the transfers behind it establish withdrawals rather than a verified purchase price or a plan to sell. Arkham…

Binance has promised to cover every customer loss after a breach it estimates affected $6.3 billion. Its recovery effort now involves several different processes, from stablecoin freezes to tracing assets that no token issuer can block. Binance has estimated that…

Ripple’s Coinbase launch gives RLUSD users access through 3 blockchains, while the stablecoin’s backing and redemption still depend on the institutions behind it. Coinbase gives customers another way to buy, hold and transfer RLUSD, but the route back to dollars…

Teku and Besu have updated their Docker images after weak certificate keys created a risk for software connecting to external services, including some Ethereum validator setups. The immediate question for operators is whether their software could accept a fake certificate…

Dogecoin, Shiba Inu, Pepe, Bonk and Floki enter November with different reasons to attract traders, from new wallet features to established communities and active trading markets. November brings a different test for each of these tokens. Dogecoin has an app…

Bitcoin has recovered from its summer lows, but investors still face an uncertain start to November as demand improves unevenly and US interest rates remain elevated. Investors heading into November are weighing Bitcoin’s recent gains against the selling that could…

Janus Henderson and Centrifuge have launched a fund tied to the Nasdaq-100 on Stellar, putting a licensed equity benchmark into a blockchain-native investment product. JQQQ is a share of a British Virgin Islands segregated portfolio available only to eligible investors…

Crypto-linked political groups have spent roughly $176 million across more than 100 U.S. midterm races, according to a Reuters review of campaign-finance filings through October 20. Fairshake and its affiliates account for about $150.8 million. The spending may help elect…

Ripple has said its proposed national trust bank received final federal approval on October 26, giving the company a federally supervised institution to manage the assets behind RLUSD. The stablecoin will still be issued by Standard Custody & Trust Company,…

Bitcoin payments have reached more than a million U.S. sellers through Square, yet the group behind much of the network’s payment software says everyday spending remains scarce. Spiral’s October 27 report is an unusually frank assessment from a Block-backed developer:…

TL;DR: Ripple unveiled additional Ripple Treasury capabilities at Swell 2026 on October 26, presenting a platform intended to connect cash forecasting, reconciliation, liquidity decisions and payments across conventional and digital rails. The decisive proof will be how smoothly the orchestration system links approved decisions to executed payments, and how 24/7 Returns discloses risks, eligibility and the origin of returns.

The latest development in Ripple’s corner of the digital-asset market is worth examining beyond the headline. A 2026-10-26 announcement describes a concrete change, but the investment consequences will depend on how it works in practice. The original record is available in the original company statement; here is what it establishes, why the distinction matters and what remains unproven.

What the source actually says

Ripple unveiled additional Ripple Treasury capabilities at Swell 2026 on October 26, presenting a platform intended to connect cash forecasting, reconciliation, liquidity decisions and payments across conventional and digital rails. The announcement includes a feature called 24/7 Returns for qualifying corporate customers. Ripple says eligible assets held in a Ripple wallet, including its RLUSD stablecoin, may generate returns outside the hours when ordinary bank-based cash investments are available. The language is conditional: the company has not promised a universal guaranteed rate for all wallet holders.

Corporate treasury is less about speculative token exposure than ensuring obligations can be met on the right day, in the right currency, with a reliable record of available balances. Ripple says its orchestration layer works with treasury-focused AI tools to connect information and execution. That may reduce handoffs between reports, bank portals and payments systems, but integrations and risk approvals determine what a finance department can actually automate. Cash visibility without dependable settlement can be as frustrating as fast settlement without trustworthy books.

The 24/7 framing responds to a genuine operational mismatch: businesses and crypto markets run beyond banking opening hours, while many familiar cash-management products still have cutoffs. Stablecoin rails could reduce that gap for approved users. However, an available balance in a digital wallet is not automatically equivalent to a protected deposit at an insured bank. Finance teams must distinguish counterparty risk, liquidity, redemption access and the nature of any return-generating activity before allocating working capital.

For cryptocurrency investors, the central point is to distinguish an announced milestone from an immediate change in asset value. The underlying development can strengthen a company’s product, legal position or operating capacity without determining what a token will trade for tomorrow. The linked source establishes what was disclosed; the valuation question requires a separate assessment of customers, costs, execution and market conditions. That gap between a confirmed fact and a forecast is where much of the investment risk sits.

What matters for the market next

Ripple has positioned the system for large enterprises already accustomed to formal policies, authorisation chains and audits. The company mentions customers and partners spanning airlines, retail and professional services, but those references should not be taken as confirmation that every organisation uses every newly announced feature. A careful implementation would begin with narrow limits, segregation of duties, tested exception handling and clear rules for when an automated proposal can become a transfer of money.

The decisive proof will be how smoothly the orchestration system links approved decisions to executed payments, and how 24/7 Returns discloses risks, eligibility and the origin of returns. It is easy to announce a connected dashboard; it is harder to reconcile every transaction when payments fail or assets need to move back to a bank account. The launch is a meaningful extension of Ripple’s enterprise ambitions, but treasury teams should demand product-level evidence rather than assuming an always-on label removes traditional cash-management constraints.

Market watchers should also avoid treating a company’s or regulator’s headline as a substitute for terms and conditions. Tokens, shares and regulated service agreements create different rights, even when they coexist in one wallet or platform. A reliable follow-up should ask which entity is responsible, what a holder can actually redeem or transfer, and whether the claimed advantages appear in live activity. Those questions are more informative than an unsupported price target or an assumption that adoption is inevitable.

Primary source: original company statement (2026-10-26).

Written by the News Desk and edited by Samuel Rae.

South Korean officials are discussing another postponement of the crypto income tax scheduled for January 1. The presidential office has signalled support for moving the start to 2029, but the National Assembly has not passed that change. For a trader,…

Pi Network has put its developers on the calendar for November 17 to 19, promising new tools, app demonstrations and details of another hackathon. PI’s market price has moved the other way. After changing hands around $0.0787 when the summit…

Canada has proposed a stablecoin rule that would let an issuer reward a payment while barring it from paying people to keep tokens in their wallets. The distinction appears in draft regulations published October 24, with comments open until December…

Solana has been running Alpenglow on mainnet since October 21, replacing a voting system that could take several seconds to finalize a block with one designed to finish in a fraction of a second. The Solana Foundation records the switch…

The wallets were supposed to belong to CoinDCX’s past. After a July 2025 security breach, the Indian exchange had replaced the compromised infrastructure and told customers to use new deposit addresses. Some customers kept sending money to the old ones,…

Hong Kong’s first two licensed issuers are no longer waiting to launch. HSBC began rolling out RedCoin through PayMe on October 23, while Anchorpoint’s HKDAP has been in a restricted institutional phase since August. Their next challenge is getting regulated…