# The hot wallet signed a delegate

2026-10-29

Wallets Etherscan labels as Binance hot wallets sent billions to a new address this afternoon after an EIP-7702 delegation was set on one of them. Binance has not called it a hack. CZ has. Tether and Circle froze on the order of $1.8 billion in stablecoins. How the authorization was signed is the actual incident.

Canonical: https://www.fabiocti.com/notes/the-hot-wallet-signed-a-delegate/
Author: Fabio Correia

The wallet did not send. It started executing someone else’s program.

EIP-7702, the Pectra set-code path, lets an ordinary account run contract code for as long as the delegation sits on it. Unchained’s reconstruction: an address funded in part through Tornado Cash’s 0.1 ETH pool deployed a contract, then at 20:20 UTC set that code on the wallet Etherscan labels Binance 14. Four minutes later 14 swept itself. Binance 16 sent 28,005.6 ETH to the same new address. Calls through 14 pulled 780 million USDC, then 43 million more, off a wallet labeled Hot Wallet 34. Unchained’s Ethereum count on the receiver, 20:24–21:04 UTC: about $3.52 billion — 197,170 ETH, 1.68 billion USDT, 823 million USDC, and about $564 million across 62 other tokens. Other firms’ multi-chain tallies go higher. Bitcoin and Tron outflows are not this paragraph. Binance has not published a number.

How the 7702 authorization was signed is not known. That signature is the incident. Once it is on the account, later transfers do not need the wallet to sign again. Odysseas of Phylax, this afternoon: the delegation persists; the code can keep authorizing. Unchained was still seeing 14 delegated after Binance’s first statement, and another ~200 million USDT moved into the already-frozen receiver.

Tether blacklisted the receiver around 21:01 UTC. Circle followed at 21:04 with 823 million USDC. CZ, who does not run the exchange, posted that it looks like a hack, thanked Tether (~$971 million) and Circle (~$823 million), and said as a shareholder he expects users covered. Paolo Ardoino later said Tether had frozen more than $1.567 billion across related addresses. ETH has no equivalent switch. Binance’s first line was “potential security issue,” no confirmed user impact. The revised line, 21:29 UTC: user funds are completely safe. It has not used the word hack.

PeckShield’s alert landed more than twenty minutes after the first public on-chain flag. The freeze is the part that worked. The part that had to work in forty minutes, across two issuers, while a delegated hot wallet was still live.

## What $3.5 billion will be asked to cover

It will be briefed as every Binance customer, and as the largest hack in history. It is labeled hot wallets on Ethereum, a 7702 delegate, and a receiver the dollar issuers could still freeze. It is not a confirmed user-fund loss. It is not a confirmed Bitcoin take. Do not add Polymarket’s $2.7 million. That was a browser. This was a key.

It will be briefed as a person at a desk. Forty minutes, 62 tokens, a second hot wallet, a mixer-funded setter. That is a loop. The interesting version is not this afternoon. It is a swarm that never clocks out: watch every set-code on every labeled exchange hot wallet, race the freeze, and do it again on the next chain that has no Tether. This file does not prove that swarm exists. It proves the interface it would use already shipped.

If you hold on Binance, their “user funds are safe” is the letter until they retract it. A connect, a seed-phrase check, a “re-authorize the hot wallet” page is not them.

The hot wallet signed a delegate. The program kept signing.