According to Blockaid’s analysis, one of the 50 authorizations the attacker targeting Binance 14’s hot wallet sent in a single transaction was valid, which was enough to activate the malicious contract.
A Blockaid investigation reported by Wu Blockchain focuses on how Ethereum’s EIP-7702 authorization mechanism was used in the Binance attack. According to the analysis, because the attacker could not determine the exact counter value the hot wallet would have during the transaction, they sent 50 authorizations covering different values in the same transaction.
One match activated the malicious contract
For the authorizations to be valid, the account counter, known as the nonce, had to match its value at the time the transaction was executed. The authorizations covered 50 different values, from 18.914.775 to 18.914.824.
Only one of them matched. According to Blockaid, that match caused the wallet’s account code to be redirected to a malicious contract prepared to transfer assets. This enabled the contract selected by the attacker to operate on the wallet.
Assets sent to the wallet later may also be targeted
Only the address specified by the attacker can call the function in the analyzed contract that transfers assets in bulk. The function can transfer the wallet’s ETH and ERC-20 tokens while leaving 1 ETH to cover transaction fees.
Blockaid says this setup creates a risk that assets sent to the wallet later could also be transferred. The warning concerns the malicious authorization in the Binance 14 wallet examined in the investigation.
We covered the role of EIP-7702 authorization in the attack in our previous report. This time, Blockaid’s investigation explains how a match with just one of the authorizations covering different counter values activated the contract.
Not investment advice.