As of 30 October 2026, normally, a crypto wallet is controlled by its owner, and each transaction needs that owner's authorisation. The Binance breach of 29 October 2026 reportedly worked differently: according to reports, an Ethereum feature called EIP-7702 was used on a wallet known as Binance 14, turning it into what investigators describe as a sweeper.

EIP-7702, in plain words, lets an ordinary wallet account temporarily hand control to a piece of code. Instead of the owner signing each transfer one by one, the code attached to the account can act on the account's behalf, following the instructions written into it. That is the key idea: control passes, for a time, from a person signing transactions to code executing them.

From wallet control to sweeper code

A sweeper is a particular use of that idea. Sweeper code is written to forward funds onward as soon as they arrive, or to move funds already in the account to another address, without waiting for a fresh signature for each movement. Once the wallet was turned into a sweeper, the reported result was that funds did not sit in Binance 14 waiting to be withdrawn by their owner. They were forwarded onward by the code.

The scale of that forwarding is one of the clearest reported figures in the incident. Around 204,500 ETH was reported moved from Binance 14, and ETH backing fell to near 94 percent, down from 100 percent on 1 October. The breach overall is estimated at about $6.3 billion, the largest crypto theft on record, ahead of the $1.5 billion Bybit theft in 2025, and the investigation is ongoing with figures preliminary.

EIP-7702 was not the first step in the reported chain. Preliminary investigation findings point to a compromised DevOps engineer's laptop, which may have let an attacker access a service container and submit unauthorised withdrawal transactions. The EIP-7702 step explains how, once access was gained, a wallet could be made to forward funds through code, rather than through a series of individually signed withdrawals.

Code control is not key theft

One finding that shapes how this should be understood is what investigators have not found. No evidence of a wallet private key leak has been found so far, on a preliminary basis. That matters because it suggests, at this stage, that the reported mechanism was about gaining access and then using code delegation, rather than about stealing the private keys themselves. That finding remains preliminary and could change.

The distinction between code control and key theft also explains why the sweeper description is used. If private keys had simply been copied, the attacker could sign transfers directly. A sweeper, by contrast, is code doing the moving, which is why reports describe Binance 14 as having been turned into a sweeper rather than simply emptied by a signed transfer.

What happened after the funds moved is part of the same reported picture. About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC, and Binance co-CEO Yi He has said all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin, and that user funds are safe. The next proof-of-reserves snapshot, due on 1 November 2026, will show whether stolen assets were replaced. Readers should rely on official Binance channels for confirmed updates.

Frequently asked questions

FAQ: What is EIP-7702 in plain words? A feature that lets a wallet temporarily hand control to code, so the code can act on the account's behalf. What is a sweeper? Code that forwards funds onward, in this case reportedly from Binance 14, from which around 204,500 ETH was moved. Were private keys leaked? No evidence of a wallet private key leak has been found so far, on a preliminary basis.