Shenyu reviews the Binance hack incident: attackers rehearsed twice in advance and pre-planned a list of 64 token transfers.

BlockBeats news, October 30: Cobo co-founder Shenyu posted a video on social media, providing a detailed on-chain review of the entire Binance hack incident.

Start of the Attack and Asset Transfer

At 4:20 AM on October 30, a transaction containing 50 authorization requests was broadcast on-chain. The authorizer was a hot wallet of the Binance trading platform, and the transaction was signed using the wallet's own private key. About 3 minutes later, the assets in the wallet were transferred in bulk. Based on this morning's coin prices, approximately $5.8 billion in assets were moved across three chains, including $1.4 billion in Bitcoin-related assets; Binance has not yet confirmed whether it was hacked.

Attack Technical Path and Prior Preparation

This incident involves the EIP-7702 authorization mechanism. After signing such authorization, the wallet is taken over by a specific program until the authorization is revoked. The attacker's program is single-purpose, recognizing only one controller and only executing asset transfers. These 50 authorization requests carried consecutive serial numbers from 50, and they take effect when the serial numbers match the wallet's current state. The issue currently points to the signing process; whether it was a private key leak or exploitation of the signing system, Binance has not yet disclosed. Prior signs showed that since the afternoon of the day before, the attacker had withdrawn small amounts from the Tornado Cash mixer three times as gas fees. From the previous night to the early morning, they used a test wallet for two drills, with the last drill ending 3.5 hours before the official operation.

Asset Sweep and Defense Game

The attacker had pre-prepared a transfer list covering 64 types of tokens. At 4:24 AM, the first bulk transfer was completed, including 167,000 ETH, 1.6 billion USDT, and more than 60 other tokens, leaving only 1 ETH. 24 seconds later, Binance's second hot wallet transferred out 28,000 ETH; this time, the transfer instruction was signed directly using the attacker's private key. At 4:41 AM, the attacker, using the identity of the first wallet, instructed the USDC contract wallet under its control to transfer out 823 million USDC. By 6:40 AM, the attacker had made four round trips.

At the same time as the asset transfers, a game of freezing and anti-freezing unfolded in parallel. Because stablecoin issuers such as USDT and USDC have freezing capabilities, while ETH is difficult to freeze, the attacker quickly converted freezable assets into non-freezable assets. Among them, 435 million USDT was converted into 160,000 ETH. At the latest prices, these ETH are worth only $364 million, and this single conversion operation resulted in a loss of $70 million.

Freezing Measures by All Parties and On-Chain Anomalies

As freezing measures took effect, Tether froze 1.38 billion USDT, Circle froze 823 million USDC, and Ripple froze 40.54 million RLUSD along with several other tokens. Of the $3.75 billion in assets stolen on the Ethereum chain, $2.4 billion has been successfully frozen. On the Tron chain, $630 million was also transferred out, of which Tether froze $380 million. The unfrozen assets are mainly ETH; as of 7:40, nearly 460,000 ETH remain in 4 brand-new addresses with only inbound transfer records. At almost the same time, a Binance Bitcoin hot wallet transferred out 18,270 BTC, which was subsequently split into 19 portions and transferred to 19 new addresses. Whether this was theft or an emergency transfer by Binance remains unclear. According to reports, on-chain analytics platform Arkham has flagged it as hacker-related, but Binance has not yet confirmed, and no mention of BTC was found in its public statements.

Follow-Up Warnings

Until 6:55 AM Beijing time today, Binance also used the private key to sign, transferring the untransferred fragmented tokens back to its own wallet. This indicates that the private key is still controlled by Binance, but the relevant authorization has not yet been revoked.

Based on on-chain data analysis, the core issue lies in the signing process, with no contract vulnerabilities found. This incident serves as a wake-up call for the entire industry: all trading platforms need to investigate whether their own signing systems carry the risk of signing out unintended authorizations.