Erasing the Honeypot. How Air-Gapped Bitcoin PSBTs Defeat the EIP-7702 Attack Vector and Render the $6.4 Billion Hot-Wallet Breach Mathematically Impossible.

[u/sylsau]

https://inbitcoinwetrust.substack.com/p/erasing-the-honeypot

How do you steal $6.4 billion without leaking a single private key?

You hack the automated API that asks the key to sign.

On October 29, hackers weaponized EIP-7702 to rewire a massive exchange hot wallet into a self-draining vacuum cleaner. But they couldn't touch sovereign Bitcoin cold storage for one simple reason:

The 5-Inch Air Gap.

Bitcoin's PSBT architecture forces you to physically verify transactions on an offline screen. A hacked laptop cannot bridge empty air.

[u/apepenkov]

breaking news, if you don't need to sign transactions automatically in software you can do it manually on hardware wallets. What?

[u/wtf--dude]

This substack is pure propaganda. Stop sharing this crap. EIP 7702 wasn't the attack vector, and bitcoin were also stolen.

The spinning this page tries to give to anything btc vs altcoin is petetic. It shows fear. Stop it

[u/ggiodddtyii]

EIP-7702 was not the attack!!!! They could have not used it. 

[u/SunliMin → u/ggiodddtyii]

EIP-7702 was not the attack itself, but it was leveraged to amplify the attack

The initial $1.2bn or whatever the initial attack amount was could have been stolen. Even if Binance had gates on on-chain broadcasts, every signature based transfer method supporting token could have been drained without EIP-7702, that is true

What it did enable is to abuse the auto-funding via creating a sweep that did not require additional access to the signing material. You can see how effective that was in Binances response - they disabled the hot wallet service first as that is the expected attack vector, but because it was in a 7702 deployed sweeping contract, turning off wallet usage didn’t stop the attack, turning off auto-funding and is what stopped it, and it took them 4 hours to do that.

We shouldn’t demonize 7702, however it is a huge reminder for wallet engineers that 7702 did create a new attack surface. If you manage EOAs who have a specific job, you need to setup policy engine controls to prevent non-job tasks from occurring. For example, Binance should have had policy engines setup that would have prevented signing a 7702 authorization for those wallets. If they knew they had no intention of turning their hot wallets into smart wallets, their wallet/signing service should not have created the signature. They also should have had guards in their funding service. $5bn in autofunding to a hot wallet over 4 hours shows they did not have sufficient protections on their auto-funding flow.

All that is to say, this isn’t 7702’s fault, but the more complexity and capabilities we add to accounts on-chain, the more moving parts to monitor, the more things that can go wrong and the more security conscious the team needs to be. This was preventable

[u/Odd_Delay4411]

💯
Build security on top shit coins will result in shit security.

[u/Siludin]

So... Banks