Crypto: Who owns the $6.3 billion stolen from Binance?

Coin Encyclopedia Improve your knowledge of cryptos

The answer lies in a contract. We read it, with the proofs of reserves, the code of stablecoins and some stinging judgments. Here's who owns what, and above all who will pay.

It all starts on Wednesday, quietly. An anonymous wallet withdraws 0.1 ETH three times from Tornado Cash, the favorite mixer for those who want to remain discreet. A few hundred dollars in spending money, no more. On Thursday around 5 p.m., this same wallet deploys a smart contract.

Binance 14 is then already trapped. Thanks to EIP-7702, an Ethereum function which allows an address to entrust its orders to a program, the hot wallet now obeys the hacker's contract. How the attacker obtained the necessary signature remains the investigation’s blind spot.

At 9:16 p.m., the first suspicious withdrawals leave Base and Optimism. Four minutes later, 18,270 BTC left the Binance bitcoin hot wallet. Then, at 9:24 p.m., a single transaction empty Binance 14 of 64 tokens at once. Amount of the bill: $2.54 billion.

The hacker immediately began exchanging USDT for ether on Uniswap and 1inch. At 10:14 p.m., Tether and Circle finally released their first gels. Ironically, Binance 14 still saw 200.4 million USDT arrive in the evening. The hacker's contract sucks them in, and Tether freezes them upon arrival. This timeline, pieced together by Octav and Arkham Intelligence, takes just an hour and a half.

Time for inventory, and it makes you dizzy. The Octav and Arkham Intelligence tracker identifies 5.98 billion dollars taken out of Binance hot wallets. In one evening, nine blockchains passed through it.

Ethereum opens the ball with 3.78 billion dollars, including 2.54 billion from Binance 14. Bitcoin follows with 1.44 billion, arranged in packets of 1,000 BTC on around twenty new addresses. Tron, Solana and Arbitrum come in a distant second, with $32 million to $628 million each.

Nothing exotic in the basket, since these wallets were used for everyday withdrawals. As of Friday afternoon, the hacker mainly held 1.76 billion USDT and 825 million USDC. Followed by 1.4 billion in bitcoin, 1.18 billion in ether and 68 other tokens.

The trap set on Binance 14 also continued to work after the heist. A second roundup took away around a hundred small tokens, from ARKM to CHZ, for around $38 million.

Machine-translated from French