🚨 GoPlus Security Alert: Binance Multi-Chain Hot Wallet System Compromised Approximately $5.8B has been stolen from Binance’s multi-chain hot wallet system. Roughly $3B of the stolen funds have been frozen so far. Binance US is an independent platform and is not affected. BNB Chain was not attacked, and no Ethereum or EIP-7702 vulnerability is involved. On-chain evidence strongly supports unauthorized outflows. The attacker obtained valid EIP-7702 authorization signatures for the Binance 14 hot wallet, delegated the wallet to a malicious contract, and then batch-transferred ETH and 63 tokens. The attacker further took control of USDC held in Hot Wallet 34. EIP-7702 was used to increase the efficiency of asset movement. The malicious EIP-7702 delegation on Binance 14 was cleared at 00:10:35 UTC. The root issue appears to be abuse of the signing or withdrawal system. Authorization signatures across 50+ consecutive nonces, direct signed transfers from other wallets, and simultaneous multi-chain theft make “signing infrastructure compromise” more likely than “raw private-key leakage.” Multiple private-key leaks or a software supply-chain attack cannot yet be ruled out. Attacker-related IOCs: Primary attacker address: `0x7C8601d4645b93cea45F71e118A729332e6B5CA0` Malicious EIP-7702 implementation contract: `0x63e842B054Bd624a465454D533C33F573e9c6fAe` Ethereum main consolidation address / Exploiter 2: `0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c` 📌 Security Recommendations: 1. Exchanges, custodians, and high-value wallets should block EIP-7702 authorizations from high-value EOAs by default. When use is required, enforce an implementation-contract allowlist, chain-ID restrictions, independent approvals, and spending limits. Do not sign authorizations for consecutive future nonces. 2. Avoid letting one hot wallet serve as a full operator for other smart wallets. Apply least privilege by target contract, function, asset, amount, and time window. Separate signing policies and approval domains across chains, wallets, and business lines. Limit hot-wallet balances so a single signing authority cannot reach dozens of tokens or billions of dollars in assets. 3. For regular users: watch for phishing that exploits this incident. Trust only official Binance channels. Do not give passwords, verification codes, private keys, or seed phrases to any “compensation support.” When withdrawing, confirm the token and network status, test with a small amount first, and do not switch to unsupported chains out of panic.