TL;DR:
Charles Hoskinson described a contract linked to Ethereum account delegation as severely dangerous code.
CyberSatoshi’s technical analysis reported the use of 50 signed authorizations to bypass the nonces of the Binance 14 wallet.
Ethereum’s official specification documents that any delegation under EIP-7702 requires valid cryptographic signatures from the account.
Cardano founder Charles Hoskinson warned about the security risks linked to the implementation of EIP-7702 on the Ethereum network . The executive’s warning was made public this Friday, October 30, following the revelation of a technical report detailing how attackers used this mechanism to drain assets from a Binance hot wallet on Thursday, October 29.
Careful, there is some seriously dangerous code out there. https://t.co/7hp2KMJnnI pic.twitter.com/w7wM1nn0Lz
— Charles Hoskinson (@IOHK_Charles) October 30, 2026
On his X account, Hoskinson urged the community to remain cautious regarding what he termed critical code tools circulating in the ecosystem. His post directly cited a bytecode reconstruction carried out by technical analyst known as CyberSatoshi.
The report claims the attacker deployed an automated sweeper contract specifically tailored against the exchange’s infrastructure. However, Hoskinson did not specify direct technical vulnerabilities within the Ethereum protocol, nor did he elaborate on which exact aspects of the report he endorsed.
The technical discussion framed the debate around two distinct elements. On one hand, investigators are looking into how the attackers obtained authorization to sign transactions on behalf of the affected wallet; on the other, they are evaluating the operational scope that Ethereum’s delegation standard permitted once the credentials were obtained.
According to the technical reconstruction presented by CyberSatoshi, the malicious code maintained a balance of exactly 1 ETH in the wallet throughout the asset draining process. The analyst’s assessment suggests this condition aimed to prevent Binance’s automated monitoring systems from reporting failures due to insufficient balance for gas fees.
The analysis also points out that the contract executed a loop using low-level calls to check token balances in the Binance 14 address . This structure allowed the transaction sequence to keep processing other assets even if an individual contract failed or was blacklisted.
Additionally, the technical document indicated that a custom execution function interacted with an external vault holding $823 million in USDC . According to the data provided by CyberSatoshi , that contract recognized the Binance 14 address as a legitimate administrator, facilitating directives over funds external to its immediate on-chain balance.
Technical Mechanics of Delegation and Consensus Rules
The EIP-7702 proposal defines a transaction type that allows an Externally Owned Account (EOA) to temporarily delegate its execution to the logic of a smart contract.
Under traditional Ethereum architecture, an external account operates exclusively through signatures generated by its private key. With the rollout of this standard, the account can execute advanced contract logic within its own operational context, facilitating batched transaction processing.
The protocol’s technical specification establishes that each authorization must include the chain ID, the delegate’s address, and the account nonce, accompanied by a cryptographic signature. During validation, network nodes verify signature correspondence before applying the requested delegation.
In his report, CyberSatoshi acknowledged this foundational network security rule. The analyst determined that the attack strictly required access to the original private key or unrestricted signing permissions within the exchange’s internal systems.
Ethereum’s documentation does not specify how Binance’s access credentials were compromised . Nevertheless, the cryptographic requirements confirm that the network does not permit assigning delegations to third-party accounts without a properly signed authorization.
Regarding batch processing, the report states that the attacker submitted 50 consecutive authorizations with progressive nonces to front-run transaction sequence changes on the Binance 14 account. Ethereum specifications process these entries in sequential order, incrementing the nonce and executing the latest valid delegation received.
Official documentation written by the standard’s authors explicitly cautions that delegated contracts obtain unrestricted access over the account’s assets. Consequently, the technical framework dictates that wallet software must thoroughly audit any authorized code to prevent illicit transfers.
The proposal’s developers further note that the delegation remains active on the account until the owner broadcasts an authorization explicitly pointing to the zero address. Technical audits and forensic investigations remain ongoing to determine the compromise vector of the institutional credentials.
