Binance Sets Aside $6.34B to Cover Hack Losses; Attack Chain Exposes Account Abstraction Authorization Blind Spot

Binance's CEO publicly stated that the exchange has set aside $6.34 billion to cover losses from a hack, asserting that "user assets are safe." According to Decrypt, the figure corresponds to the full book loss of the incident, not a partial provision. In the history of exchange hacks, this scale ranks behind only a few extreme cases, and it is rare for a platform to fully cover the shortfall with its own funds within a short period after the event.

More noteworthy than the amount is the attack path. According to reports, the attackers did not directly compromise private keys or hot wallet signatures; instead, they combined two mechanisms. First, they exploited a contract's self-destruct logic, which cleared the account's on-chain state and thereby bypassed existing permission checks. Second, through EIP-7702 delegation, they temporarily delegated the execution rights of an externally owned account (EOA) to attacker-controlled contract code. EIP-7702 is an account abstraction capability introduced with the Pectra upgrade, allowing an EOA to set a delegation and execute batch calls within a single transaction. Its intent is to give ordinary addresses the flexibility of smart contract wallets. The problem is that when the delegated contract contains self-destruct or permission-transfer logic, the original assumption that "whoever holds the private key controls the account" is broken—the identity anchor on which approval control relies drifts the moment the delegation takes effect.

From the perspective of approval control failure, the key to the attack chain is not that signatures were forged, but that a gap emerged between the "intent" corresponding to the signature and the final execution result. Traditional risk controls verify the initiator's identity, amount, and recipient address when a transaction is initiated. But EIP-7702 delegation allows a chained call of "authorization—delegation—execution" within a single transaction, and the intermediate state is invisible to off-chain approval systems. The self-destruct mechanism further erases the contract state needed for post-hoc attribution, weakening non-repudiation at the on-chain level. This closely resembles the risk structure in agent payment scenarios where an authorization intent (mandate) is tampered with by a proxy layer: when the executing entity can dynamically change its own permission boundaries, a pre-settlement firewall that only verifies the final transaction message will miss the delegation setup step.

For the industry, this incident pushes the risks of account abstraction from theoretical discussion to the level of actual financial loss. Adoption of EIP-7702 is expanding. If wallets, custodians, and payment service providers continue to integrate delegation capabilities in 2026, they need to include "whether the delegated contract contains self-destruct or permission-transfer logic" in pre-settlement interception rules, rather than relying solely on KYC and address whitelists. For the agent payment ecosystem, this means KYA (Know Your Agent) must verify not only the agent's identity but also whether the contracts invoked by the agent maintain stable permissions throughout the transaction lifecycle. According to the report, Binance covered the losses with its own funds, stabilizing user confidence in the short term, but the technical root cause of the approval control failure will not disappear with the provision.

---

Original source: Decrypt · https://decrypt.co/382237/binance-sets-aside-6-34b-to-cover-hack-losses-ceo-says-your-assets-are-safe